istagmbh/cve-2024-53704demonstriert, wie mittels missbräuchlicher Nutzung eines Swap-Cookies eine VPN-Session übernommen werden kann. Wichtig: Dieses Projekt dient ausschliesslich zu Bildungs- und Forschungszwecken – bitte nur in Umgebungen verwenden, in denen Du explizit authorisiert bist.
nxbender is a Proof-of-Concept (PoC) for establishing a VPN connection via NetExtender.
This project is intended solely for educational and research purposes. Please only use the code in environments where you are explicitly authorized.
Install the required packages, for example using:
pip install configargparse requests colorlog pyroute2
nxbender uses configargparse to load settings from both command-line arguments and configuration files.
Default configuration files are searched in /etc/nxbender and ~/.nxbender.
An example configuration file (e.g. ~/.nxbender):
# ~/.nxbender
server = vpn.example.com
port = 4433
swap = <your_swap_cookie>
debug = True
show_ppp_log = False
max_line = 1500
You can start the program directly via Python. There are two possible ways:
python -m nxbender
Go to the directory containing the nxbender folder and run the following command:
./nxbender/__init__.py -s vpn.example.com -S "<your_swap_cookie>"
Example:
./nxbender/__init__.py -s vpn.example.com -P 4433 -S "SGVsbG9Xb3JsZA=="
Where:
-s or --server: the address of the VPN server.-P or --port: the server port (default: 4433).-S or --swap: the swap cookie (as a Base64-encoded string).--debug: enables debug mode.--show-ppp-log: outputs PPP log messages directly in the console.-m or --max-line: maximum length of a single line of PPP data.Security:
This project is intended as a PoC. Use in production environments is at your own risk. Ensure that all security-relevant measures are taken.
Root Privileges:
Some operations (e.g., setting network routes) require root privileges. Start the program with sudo if needed.
Debugging:
Use the --debug flag to get more detailed error messages and log output.
PPP Logs:
With --show-ppp-log, log messages from pppd are displayed in the console.
This project is provided under the MIT License.
This project is intended solely for educational and research purposes.
The author assumes no liability for direct or indirect damages resulting from the use of this code.