Root Code Execution via GeoIP Web API Path Traversal in OPNsense

Repository contains a single Python proof-of-concept exploit (poc.py) and a README linking to the OPNsense advisory. The script is a standalone authenticated exploit against OPNsense's GeoIP alias update mechanism. It logs into the OPNsense web UI, extracts CSRF tokens, uses API calls to set a malicious GeoIP URL, reconfigures aliases, and triggers a GeoIP update so the target downloads an attacker-controlled archive. The archive is crafted in either ZIP or GZIP format and abuses path traversal in GeoIP data handling to write files outside the intended directory. Specifically, it plants a newsyslog configuration entry under /etc/newsyslog.conf.d and a >1KB bait log file under /var/log. The malicious newsyslog entry uses the FreeBSD newsyslog R-command feature to fetch a second-stage script from the attacker HTTP server and execute it. That second stage launches a Python-based reverse shell back to the attacker, yielding an interactive root shell. The exploit also starts its own local HTTP server to serve the malicious archive and stage-2 script, plus a TCP listener for the reverse shell. Overall structure: argument parsing and configuration; payload/archive builders (build_zip, build_gzip); embedded attacker web server; login helper for authenticated session and CSRF extraction; interactive reverse shell handler; and main orchestration logic for serving payloads, exploiting the target, and waiting for root shell callback.