From Persistence to Pre-Auth: Filling the Gap in the Chain

▶ Watch (1:04)

Faraday researchers Gaston Aznarez and Octavio Gianatiempo first presented Draytek router vulnerabilities at DEF CON the previous year. Their focus was persistence, specifically kernel modules that survive factory resets and firmware updates. They identified over 5,000 exposed devices, mostly in the UK, and found bugs from information disclosure to remote code execution. What they hadn’t examined was the CGI request parser. Forescout’s DrayBreak research at Black Hat Europe 2024 flagged a buffer overflow in get_CGI, pointing them back to that attack surface.

The TR-69 STUN Parser and an Unauthenticated Stack Overflow

▶ Watch (5:43)

The get_CGI function parses query string parameters into a stack buffer without checking the number of arguments. Forescout found the version handling HTTP query strings, but the Faraday team found the same vulnerable pattern inlined in the TR-69 STUN handler. That handler runs on a non-default UDP port the router listens on regardless of whether a binding handshake has completed. Sending enough query-style arguments overflows the stack buffer and overwrites the return address, giving an attacker unauthenticated remote code execution from the internet.

Integer Overflow to Heap Overflow in the CGI Parser

▶ Watch (10:48)

The second bug sits in the same get_CGI function, in the POST request path. Content-Length is read as a signed 32-bit integer. Setting it to the maximum positive 32-bit value causes malloc to add one, wrapping to the minimum negative value. Because the allocator also uses signed comparisons, the allocation lands in the 24-byte slab cache. Writing a POST body of any real size overflows that object. The team then overwrites free-list pointers in the slab metadata to achieve an arbitrary write at any address they choose.

Executing Code and Planting Persistent Kernel Backdoors

▶ Watch (16:29)

On MIPS, all exceptions route through a general handler that indexes a table of exception-specific handlers by cause code. The arbitrary write overwrites the illegal-address-load entry in that table to point at a network reception buffer holding attacker-controlled shellcode. A null-pointer dereference bug from the 2024 talk triggers the exception, executing the shellcode. The shellcode resets the admin password. With that access, the attackers upload a malicious DLM kernel module. DLMs persist across reboots, factory resets, and firmware updates because they sit on a separate flash partition.

Mass Router Reboots and the Evidence of In-the-Wild Exploitation

▶ Watch (20:55)

In March, reports surfaced of Draytek routers rebooting without cause. The Draytek security advisory linked the issue to vulnerabilities disclosed in early March, matching the two bugs shown in this talk. The researchers’ hypothesis: failed exploitations crash the router, causing the reboots. Successful exploitations are silent. Shellcode landing addresses vary by firmware version and model, so attackers probing multiple versions would produce many crashes alongside silent successes. The team set up four honeypots across countries with high Draytek deployments but captured no exploitation attempts.

Notable Quotes

but that’s not enough. We wanted more Gaston Aznarez · ▶ 4:00

The router is always listening. Gaston Aznarez · ▶ 10:12

in a separate partition on the flash. Octavio Gianatiempo · ▶ 17:27

Key Takeaways

  • A compiler-inlined function hid the same vulnerable pattern from Forescout’s prior research.
  • Setting Content-Length to INT_MAX converts an integer overflow into a 24-byte heap allocation, then an arbitrary write.
  • DLM kernel modules encrypted with a symmetric key extracted from firmware survive factory resets and firmware updates.