dir_300_645_815_upnp_rce.py 文件源码

def check(self):
        buf = ("M-SEARCH * HTTP/1.1\r\n"
               "Host:239.255.255.250:1900\r\n"
               "ST:upnp:rootdevice\r\n"
               "Man:\"ssdp:discover\"\r\n"
               "MX:2\r\n\r\n")

        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
            sock.settimeout(10)
            sock.connect((self.target, 1900))
            sock.send(buf)
            response = sock.recv(65535)
            sock.close()
        except Exception:
            return False  # target is not vulnerable

        if "Linux, UPnP/1.0, DIR-" in response:
            return True  # target is vulnerable

        return False  # target is not vulnerable