CVE-2024-46451

TOTOLINK AC1200 T8 Exploit - Buffer Overflow Vulnerability

This repository contains a Python script that exploits a buffer overflow vulnerability in the TOTOLINK AC1200 T8 (version v4.1.5cu.861_B20230220) in the setWiFiAclRules function via the desc parameter.

Vulnerability Details

• Vulnerability Type: Buffer Overflow
• Affected Function: setWiFiAclRules
• Affected Version: TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220
• Impact: An attacker can exploit this vulnerability to execute arbitrary code or crash the device.

Features

• Payload Customization: Specify payload size and choose between a basic or random payload.
• Response Logging: Logs the status and text of responses from the device for analysis.

Prerequisites

• Python 3.x: Ensure you have Python 3.x installed.
• Requests Library: Install the requests library if not already installed.

pip install requests

Usage

Clone the repository:

bash

git clone https://github.com/vidura2/CVE-2024-46451.git cd CVE-2024-46451

Modify the script if necessary.

Run the script using the following command format:

python exploit_totolink.py <target_url> <session_cookie> <payload_size> <random_payload (yes/no)>

Example:

    python exploit_totolink.py http://127.0.0.1/cgi-bin/cstecgi.cgi "SESSION_ID=2:1721039211:2" 4096 yes

Expected Output

The script will print the status code and response text from the device for each exploit attempt. A successful exploit will indicate the potential for unauthorized access or code execution.

Disclaimer

This script is intended for educational purposes only. The author is not responsible for any misuse or damage caused by this exploit. Always ensure you have permission before testing or exploiting vulnerabilities.

Contributing

Feel free to submit issues or pull requests for improvements or additional features!

License

This project is licensed under the MIT License - see the LICENSE file for details.