The following code is for security research and authorized testing only.
python
# CVE-2025-67813 PoC - Quest KACE Desktop Authority Named Pipe Enumeration
# This PoC demonstrates enumeration of named pipes with weak permissions
import win32security
import win32api
import ntsecuritycon as con
import os
def enumerate_named_pipes():
"""Enumerate all named pipes and check their security descriptors"""
print("[*] CVE-2025-67813 - KACE Desktop Authority Named Pipe Enumeration\n")
# Common KACE Desktop Authority named pipe patterns
kace_pipe_patterns = [
"KACE_*",
"DA_*",
"\\\\.\\pipe\\KACE*",
"\\\\.\\pipe\\DA*"
]
# Use PowerShell to enumerate named pipes
ps_script = '''
Get-ChildItem \\.\pipe\ | Select-Object Name, FullName
'''
print("[*] Enumerating named pipes...")
# Check if current user has access to pipes
try:
# Attempt to open a common pipe path
pipe_path = r"\\.\pipe\"
handles = os.listdir(r"\\.\pipe\")
print(f"[+] Found {len(handles)} named pipes")
for handle in handles:
if any(pattern.replace("*", "") in handle for pattern in ["KACE", "DA"]):
print(f"[+] Potential KACE pipe found: {handle}")
# Check DACL for the pipe
try:
sd = win32security.GetFileSecurity(
rf"\\.\pipe\{handle}",
win32security.DACL_SECURITY_INFORMATION
)
dacl = sd.GetSecurityDescriptorDacl()
if dacl:
print(f"[*] DACL entries for {handle}:")
for i in range(dacl.GetAceCount()):
ace = dacl.GetAce(i)
print(f" - ACE {i}: {ace}")
except Exception as e:
print(f"[-] Could not check DACL: {e}")
except Exception as e:
print(f"[-] Error enumerating pipes: {e}")
def check_privilege_escalation():
"""Check if low-privilege access to KACE pipes could lead to privilege escalation"""
print("\n[*] Checking for potential privilege escalation vectors...")
# Check current user privileges
try:
token = win32security.OpenProcessToken(
win32api.GetCurrentProcess(),
win32security.TOKEN_QUERY
)
print(f"[+] Current process token: {token}")
# Check if we can access KACE service
print("[*] Attempting to identify KACE service named pipes...")
except Exception as e:
print(f"[-] Error: {e}")
if __name__ == "__main__":
enumerate_named_pipes()
check_privilege_escalation()
print("\n[*] Note: This is for authorized security testing only")