Router Web

hackthebox

Task: Exploit a C++ ARM32 web server binary to enable dev mode and achieve command injection. Solution: Trigger a use-after-free by deleting a Config object, allocate a Desktop object at the same heap address (same chunk size), overwrite the vtable pointer via timestamp field to point to enable_dev_mode function, then use /admin/ping endpoint for command injection via popen.