Unauthenticated RADIUS Command Injection in Cisco Secure Firewall Management Center

This repository is a functional exploit (PoC) for CVE-2025-20265, targeting Cisco Secure FMC (Firepower Management Center) systems, specifically version 7.7.0. The exploit is written in Rust and consists of a single main code file (src/main.rs) along with standard Rust project files. The exploit works by attempting to achieve remote code execution (RCE) on the target system. It does so by sending a crafted SSH command to the target, which, if successful, causes the target to make an HTTP request back to the attacker's server (the attacker's IP and port are configurable). This callback confirms successful code execution. The tool supports scanning single targets or multiple targets from a file, and includes logic to detect honeypots and identify the target's version via icon hash. The README provides detailed build and usage instructions, including example commands and configuration notes. The exploit requires the attacker to have a reachable public IP and an open port for callback verification. The code is operational and not just a detection script, as it attempts actual exploitation and provides feedback on success.

This repository is an educational simulation of a management-plane remote command execution (RCE) vulnerability, inspired by a real-world Cisco FMC vulnerability (CVE-2025-20265). The main components are: - server.py: Implements a minimal HTTP server that listens on port 8444 and exposes a /api/config endpoint. If a POST request is made to this endpoint with JSON containing a 'run' key starting with 'CMD:', the server executes the provided shell command and returns the output. This is intentionally unsafe and for lab use only. - entrypoint.sh: Initializes the environment by generating a random flag and writing it to /opt/flag.txt, then starts the server. - exploit.sh: Bash script that sends a crafted POST request to the vulnerable endpoint, allowing the user to execute arbitrary commands (default: 'cat /opt/flag.txt' to retrieve the flag). - Dockerfile: Sets up the environment for running the simulation in a container. The exploit demonstrates the impact of unsafe command parsing in management APIs. The only fingerprintable network endpoint is the HTTP API at /api/config on port 8444. The file /opt/flag.txt is the target for flag-capture in the simulation. The repository is structured for educational use and is not a real-world exploit against Cisco products.