CVE-2026-34515: AIOHTTP Windows路径信息泄露

import asyncio import aiohttp async def check_path_leak(url): """ PoC to check for NTLMv2 remote path information leakage. Target a static resource endpoint on a vulnerable Windows server. """ async with aiohttp.ClientSession() as session: try: async with session.get(url) as resp: print(f"Status: {resp.status}") headers = dict(resp.headers) print(f"Response Headers: {headers}") text = await resp.text() # Check for common Windows path patterns in response body or headers if "\\" in str(headers) + text or ":" in text: print(f"[!] Potential path information detected.") else: print("[+] No obvious path leakage detected.") except Exception as e: print(f"Error connecting to target: {e}") # Usage example: # asyncio.run(check_path_leak("http://target-server:8080/static/test.txt"))