CVE-2024-46451 PoC — TOTOLINK AC1200 安全漏洞

Source

Associated Vulnerability

Readme

# CVE-2024-46451

# TOTOLINK AC1200 T8 Exploit - Buffer Overflow Vulnerability

This repository contains a Python script that exploits a buffer overflow vulnerability in the **TOTOLINK AC1200 T8** (version v4.1.5cu.861_B20230220) in the `setWiFiAclRules` function via the `desc` parameter.

## Vulnerability Details

- **Vulnerability Type**: Buffer Overflow
- **Affected Function**: `setWiFiAclRules`
- **Affected Version**: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220
- **Impact**: An attacker can exploit this vulnerability to execute arbitrary code or crash the device.

## Features

- **Payload Customization**: Specify payload size and choose between a basic or random payload.
- **Response Logging**: Logs the status and text of responses from the device for analysis.

## Prerequisites

- **Python 3.x**: Ensure you have Python 3.x installed.
- **Requests Library**: Install the `requests` library if not already installed.

```bash
pip install requests
```
## Usage

    Clone the repository:

    bash

git clone https://github.com/vidura2/CVE-2024-46451.git
cd CVE-2024-46451

Modify the script if necessary.

Run the script using the following command format:

``` bash 

python exploit_totolink.py <target_url> <session_cookie> <payload_size> <random_payload (yes/no)>
```
## Example:

```bash

    python exploit_totolink.py http://127.0.0.1/cgi-bin/cstecgi.cgi "SESSION_ID=2:1721039211:2" 4096 yes
```
Expected Output

The script will print the status code and response text from the device for each exploit attempt. A successful exploit will indicate the potential for unauthorized access or code execution.
## Disclaimer

This script is intended for educational purposes only. The author is not responsible for any misuse or damage caused by this exploit. Always ensure you have permission before testing or exploiting vulnerabilities.
## Contributing

Feel free to submit issues or pull requests for improvements or additional features!
## License

This project is licensed under the MIT License - see the LICENSE file for details.

File Snapshot

 [4.0K]  /data/pocs/ecf5628079bfdc0c181d83088e54f1727434cd60
├── [2.0K]  exploit_totolink.py
└── [2.0K]  README.md

0 directories, 2 files

Remarks