Remote Code Execution in TP-Link TL-WR840N oal_wan6_setIpAddr

This repository contains an exploit for CVE-2022-25064, an OS command injection vulnerability in the TP-Link WR840N router's IPv6 configuration functionality. The main exploit script (CVE-2022-25064.py) is written in Python and automates the exploitation process by sending crafted HTTP POST requests to the router's web interface at /cgi?2&2. The script requires administrator credentials and the target router's IP address. It uses the command injection to download a MIPSLE-compiled reverse shell binary (reverse_shell_mipsle.c) via TFTP to /var/tmp/r on the router, makes it executable, and runs it. The reverse shell binary, when executed, connects back to the attacker's specified IP and port, providing remote shell access. The repository structure is straightforward: the Python exploit script, a README with a brief description, and the C source code for the reverse shell payload. The exploit is operational and provides a working remote shell if the attacker's prerequisites are met.

This repository contains a working exploit for CVE-2022-25064, a remote command execution vulnerability in the TP-LINK TL-WR840N router. The exploit is implemented in Python (exp-tl-wr840n.py) and targets the router's web interface by sending a crafted POST request to the /cgi?2&2 endpoint. The exploit injects shell commands into the X_TP_ExternalIPv6Address field, allowing arbitrary command execution as root on the device. The provided exploit automates a three-stage attack: (1) downloading a binary from the attacker's TFTP server, (2) making it executable, and (3) running it. The attacker must have valid administrator credentials for the router. The README.md provides a detailed description, example requests, and context for the vulnerability. The repository is operational and can be used to achieve full remote code execution on vulnerable devices.