CVE-2022-37122 PoC — Carel pCOWeb HVAC BACnet Gateway 路径遍历漏洞

Description

CVE-2022-37122 Path Traversal Scanner

介绍

# CVE-2022-37122 Path Traversal Scanner

![Banner](https://raw.githubusercontent.com/bughuntar/CVE-2022-37122-Exploit/refs/heads/main/banner.png)
![Shell Script](https://img.shields.io/badge/Shell-Bash-green)
![License](https://img.shields.io/badge/License-MIT-blue)

A robust and feature-rich scanner for detecting the Carel pCOWeb `logdownload.cgi` path traversal vulnerability (CVE-2022-37122). Designed for security researchers and authorized penetration testers.

## 🚨 Important Notice

**EDUCATIONAL / BUG BOUNTY USE ONLY**

This tool is intended for:
- Educational purposes
- Authorized security testing
- Bug bounty hunting with explicit permission

**DO NOT** use this tool against systems you do not own or lack explicit written permission to test.

## ✨ Features

- 🎯 **Safe Default Payload**: Uses `/etc/hostname` (non-sensitive file) for responsible testing
- 🚀 **High Performance**: Multi-threaded scanning with configurable concurrency
- 📊 **Comprehensive Reporting**: CSV output with detailed findings
- 💾 **Evidence Collection**: Automatically saves response samples for validation
- 🎨 **User-Friendly**: Color-coded output with progress indicators and summary
- 🔧 **Flexible**: Support for single targets or target lists
- 🛡️ **Safe**: Built-in safeguards and clear responsible usage warnings

## 📋 Requirements

- `bash` (v4.0+)
- `curl`
- `figlet` (for banner - automatically installed)

## 🛠️ Installation

```bash
git clone https://github.com/bughuntar/cve-2022-37122-scanner.git
cd cve-2022-37122-scanner
chmod +x cve-2022-37122-scanner.sh
```

## 📖 Usage

### Basic Single Target Scan
```bash
./cve-2022-37122-scanner.sh -u http://target-ip
```

### Scan Multiple Targets
```bash
./cve-2022-37122-scanner.sh -f targets.txt -t 16 -o results.csv
```

### Advanced Options
```bash
./cve-2022-37122-scanner.sh \
  -u https://device.local \
  -p '../../../../../../../../etc/passwd' \
  --insecure \
  -v \
  -t 20 \
  -o detailed_findings.csv
```

## ⚙️ Options

| Option | Description | Default |
|--------|-------------|---------|
| `-u, --url URL` | Single target URL | - |
| `-f, --file FILE` | File containing target URLs | - |
| `-o, --output FILE` | Output CSV file | `findings.csv` |
| `-s, --samples-dir DIR` | Directory for response samples | `samples` |
| `-t, --threads N` | Number of concurrent threads | `8` |
| `-p, --payload STR` | Path traversal payload | `/etc/hostname` |
| `--insecure` | Ignore SSL certificate errors | - |
| `-v, --verbose` | Verbose output | - |
| `-h, --help` | Show help message | - |

## 📁 Output

### CSV Format
The scanner generates a CSV file with the following columns:
- `host`: Target host URL
- `url`: Full exploitation URL
- `status`: Vulnerability status (`VULNERABLE`, `POSSIBLE`, `NOT_DETECTED`, `ERROR`)
- `matched_pattern`: Detection pattern matched
- `sample_file`: Path to response sample

### Sample Directory
Response samples are saved in the specified directory for manual verification and evidence collection.

## 🎯 Detection Logic

The scanner uses multiple detection methods:

1. **Primary Detection**: Validates hostname format in response
2. **Keyword Matching**: Looks for common system file indicators
3. **Response Analysis**: Examines full response content

## 🔒 Responsible Usage

### Default Safe Payload
The scanner defaults to reading `/etc/hostname` which:
- Is non-sensitive
- Confirms vulnerability without exposing sensitive data
- Maintains ethical testing standards

### Custom Payloads
If using custom payloads, ensure:
- You have explicit permission to access targeted files
- You comply with all applicable laws and regulations
- You follow responsible disclosure practices

## 🎓 Educational Value

This tool demonstrates:
- Path traversal vulnerability exploitation
- Safe vulnerability verification techniques
- Mass scanning with concurrency control
- Professional reporting and evidence collection
- Ethical security testing practices

## 👨‍💻 Author

**Professor the Hunter**  
- Twitter: [@bughuntar](https://x.com/bughuntar)
- GitHub: [Professor the Hunter](https://github.com/bughuntar)

## 🤝 Contributing

Contributions are welcome! Please:
1. Fork the repository
2. Create a feature branch
3. Submit a pull request
4. Ensure code follows existing style and safety guidelines

## ⚠️ Disclaimer

This tool is provided for educational and authorized testing purposes only. The author is not responsible for any misuse or damage caused by this program. Always obtain proper authorization before conducting security testing.

文件快照

备注