Authenticated command injection in TP-Link router configuration import

This repository is a real proof-of-concept exploit for CVE-2026-3227, targeting authenticated OS command injection in TP-Link router firmware via maliciously modified backup configuration files. The repo contains 8 files total, with 5 code files across Python, C, and Bash. The main workflow is centered on POC/generate_payload.py, which decrypts a legitimate router backup, edits a specific XML field, and re-encrypts the result into a malicious config for upload. Repository structure and purpose: - POC/generate_payload.py is the primary operator-facing entry point. It accepts an original config backup, an output filename, and a short shell payload, then orchestrates decryption, XML modification, and re-encryption. - POC/python_utils/decrypt_config.py implements offline decryption of TP-Link config blobs using a hardcoded DES key (478da50bf9e3d2cf), validates the embedded MD5 digest, and reproduces the vendor’s custom decompression routine to recover XML. - POC/python_utils/xml_editor.py modifies the decrypted XML by locating a WANIPConnection block whose Name value is ewan_ipoe_d and replacing or inserting the X_TP_IfName attribute value with attacker-controlled content. - POC/python_utils/encrypt_config.py does not reimplement the vendor encryption algorithm directly. Instead, it launches the extracted TP-Link MIPS httpd binary under qemu-mipsel with QEMU_LD_PREFIX and LD_PRELOAD set, using the router’s own native routines to produce a valid encrypted config. - POC/c_hook/create_config.c is the most technically significant component. It is an LD_PRELOAD hook that intercepts __uClibc_main, swaps in a custom harness_main, dynamically loads libcutil.so and libcmm.so, resolves internal functions such as cen_compressBuff, cen_md5MakeDigest, cen_desMinDo, and dm_shmInit, computes the DES key address from the libcmm base, and invokes the router’s native config-building logic. This allows the exploit to generate encrypted backups that the target router will accept. - POC/c_hook/compile_hook.sh compiles the hook for MIPS little-endian into python_utils/create_config.so. - README.md documents the vulnerability, prerequisites, and an example upload flow using curl to POST the crafted file to /cgi/confup on the router web interface. Exploit capability: The exploit is authenticated and file-based/web-delivered. It does not directly attack the router over the network by itself; instead it prepares a malicious configuration file that an authenticated user uploads through the router’s web management endpoint. The injected payload is placed into X_TP_IfName, which the README states is later interpolated into an iptables command string in the vulnerable port-triggering path and executed via a system()-like wrapper. The payload is constrained to roughly 15 characters, so the PoC demonstrates compact commands such as ;reboot;. Successful exploitation yields root command execution on the router when the modified configuration is applied or when a Port Triggering event is created/triggered. The stated impacts are persistent reboot loops/bricking and possible persistent backdoor/LAN pivoting. Notable endpoints and artifacts include the router upload endpoint http://192.168.0.1/cgi/confup, the management page http://192.168.0.1/mainFrame.htm, the session cookie JSESSIONID, local firmware artifacts such as squashfs-root/usr/bin/httpd, and the internal libraries libcutil.so and libcmm.so used during emulated encryption. Overall, this is an operational PoC rather than a simple detector: it contains a working payload-generation chain and a practical method to produce router-acceptable malicious configuration files.

This repository is a real proof-of-concept exploit for CVE-2026-3227 targeting vulnerable TP-Link router firmware. Its purpose is to take a legitimate router backup, decrypt it, modify a specific XML field used later in command construction, and then re-encrypt the configuration into a format the router will accept. The exploit chain is: decrypt backup -> edit XML -> re-encrypt using the vendor's own native code under emulation -> manually upload the malicious backup -> trigger Port Triggering processing so the injected shell fragment executes as root. Repository structure: the main operator entry point is POC/generate_payload.py, which orchestrates the workflow. POC/python_utils/decrypt_config.py implements DES-ECB decryption with a hardcoded key (478da50bf9e3d2cf), MD5 verification, and a custom decompression routine to recover the XML configuration. POC/python_utils/xml_editor.py locates the WANIPConnection block with Name val='ewan_ipoe_d' and updates or inserts the X_TP_IfName attribute value with the attacker-supplied payload. POC/python_utils/encrypt_config.py does not reimplement the router encryption algorithm; instead it launches qemu-mipsel against an extracted TP-Link httpd binary with LD_PRELOAD=create_config.so and QEMU_LD_PREFIX=squashfs-root so the router's own libraries generate a valid encrypted config. POC/c_hook/create_config.c is the key offensive component: a MIPS-targeted shared object that hooks __uClibc_main, replaces the program's main with harness_main, dlopens libcutil.so and libcmm.so, resolves internal functions such as cen_compressBuff, cen_md5MakeDigest, cen_desMinDo, and computes the DES key address from dm_shmInit/libcmm base offsets. compile_hook.sh builds this shared object for MIPS little-endian. Main exploit capability: authenticated persistent OS command injection via malicious configuration restore. The README states the vulnerable sink is an iptables command built from unsanitized X_TP_IfName data and executed through util_execSystem/system(). The provided example payload is ';reboot;' and the repository notes a practical payload length limit of roughly 15 characters. This is enough for destructive actions like persistent reboot loops and potentially compact backdoor/bootstrap commands. The exploit is operational rather than weaponized: it includes a working payload-generation pipeline and native-code hook, but payload delivery and triggering are still partly manual and environment-specific. Fingerprintable targets/endpoints include the router upload endpoint http://192.168.0.1/cgi/confup, the management page http://192.168.0.1/mainFrame.htm, the example router IP 192.168.0.1, the required JSESSIONID cookie, and local file/library paths such as squashfs-root/usr/bin/httpd, libcutil.so, libcmm.so, and create_config.so. No external C2 or remote callback infrastructure is present; the exploit is focused on local generation of a malicious config and authenticated upload to the router web interface.