CVE-2025-64642 NMIS/BioDose不安全的文件权限漏洞

# CVE-2025-64642 PoC - 检查NMIS/BioDose文件权限 import os import subprocess import sys def check_nmis_permissions(): """检查NMIS/BioDose安装目录的文件权限""" # 常见的NMIS/BioDose安装路径 possible_paths = [ r"C:\Program Files\NMIS", r"C:\Program Files (x86)\NMIS", r"C:\Program Files\BioDose", r"C:\ProgramData\NMIS", r"C:\ProgramData\BioDose" ] vulnerable_files = [] for path in possible_paths: if os.path.exists(path): print(f"[+] Found installation directory: {path}") # 检查目录权限（Windows icacls命令） try: result = subprocess.run( ['icacls', path], capture_output=True, text=True, timeout=10 ) print(f"[>] Permissions for {path}:") print(result.stdout) # 检查可执行文件和DLL的写权限 for root, dirs, files in os.walk(path): for file in files: if file.endswith(('.exe', '.dll')): file_path = os.path.join(root, file) # 检查Users组是否有写入权限 try: perm_result = subprocess.run( ['icacls', file_path], capture_output=True, text=True, timeout=10 ) if 'Users:(F)' in perm_result.stdout or 'Users:(M)' in perm_result.stdout: print(f"[!] VULNERABLE: {file_path} - Users have write access") vulnerable_files.append(file_path) except: pass except Exception as e: print(f"[-] Error checking permissions: {e}") if vulnerable_files: print(f"\n[!] Found {len(vulnerable_files)} vulnerable files") print("[!] This system is vulnerable to CVE-2025-64642") return True else: print("\n[+] No obvious file permission vulnerabilities found") return False if __name__ == "__main__": check_nmis_permissions()