CVE-2019-25671

This Python script exploits a post-authentication remote code execution vulnerability in VA MAX 8.3.4 by injecting a malicious payload into the 'mtu_eth0' parameter of the changeip.php endpoint. The payload decodes a base64-encoded reverse shell command, granting the attacker a shell as the 'apache' user, which can then escalate to root via sudo misconfiguration.