squ1shification/pngboomer-cve-2026-77622Sliver HTTP(S) C2 PNG bomb DoS exploit — GHSA-663m-7x7m-g4fw (CVE-2026-77622)
Denial-of-service exploit for Sliver C2's HTTP(S) listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory.
Published as GHSA-663m-7x7m-g4fw.
Sliver's HTTP(S) C2 channel wraps messages inside PNG images. Each session is assigned a random nonce in the range [1, 65537), and the server only decodes PNG data from requests whose ?n= query parameter matches the session's nonce. This is a routing mechanism, not an authentication check — the keyspace is 16 bits.
The server decodes the PNG with Go's image.Decode(), which allocates width × height × bytes_per_pixel in memory. A PNG file with declared dimensions of 32767×32767 RGBA compresses to roughly 3 KB on the wire but decompresses to over 4 GB in memory. The server imposes no limit on decoded dimensions.
The exploit works in three phases:
Sliver C2 versions prior to the fix referenced in GHSA-663m-7x7m-g4fw. Any Sliver server running an HTTP or HTTPS listener is exposed.
go build -o pngboomer
No external dependencies. Standard library only.
./pngboomer -url http://target:8080/ [options]
| Flag | Default | Description |
|---|---|---|
-url | http://127.0.0.1:8080/ | Sliver HTTP C2 base URL |
-workers | 8 | Scan concurrency |
-probe-w | 2000 | Probe PNG width |
-probe-h | 2000 | Probe PNG height |
-probe-color | 2 | Probe color type (2=RGB, 6=RGBA) |
-kill-w | 32767 | Kill PNG width |
-kill-h | 32767 | Kill PNG height |
-kill-color | 6 | Kill color type (2=RGB, 6=RGBA) |
-threshold-ms | 50 | Minimum response time floor for nonce detection |
-outlier-mult | 15.0 | Adaptive threshold = baseline p99 × this |
-calibrate | 16 | Number of calibration samples |
-verify | 3 | Re-probe count per candidate nonce |
-max-nonce | 65537 | Top of nonce range (Sliver modulus) |
-probe-timeout | 5s | Per-probe HTTP timeout |
-kill-timeout | 180s | Kill request HTTP timeout |
-target-cap-mb | 10240 | Declared target memory cap (safety check) |
-nonce | 0 | Skip scan, use this nonce directly |
-scan-only | false | Find the nonce and print it without sending the kill |
-no-confirm | false | Skip TCP polling for target death after kill |
-no-color | false | Disable ANSI color output |
Default scan and kill against a local Docker target:
./pngboomer -url http://127.0.0.1:8080/ -target-cap-mb 10240
Scan only (find the nonce without killing):
./pngboomer -url https://c2.target.com/ -scan-only
Skip the scan when you already know the nonce:
./pngboomer -url http://target:8080/ -nonce 41337
The kill bomb causes a multi-GB PNG decode on the target. When testing, run the Sliver server inside a Docker container with --memory=<N>g and pass -target-cap-mb N so the tool refuses dangerous worker/probe combinations that would exceed the target's memory.
The probe PNG is large enough that decoding it takes measurably longer than the server's fast-path rejection of a wrong nonce. The scan shuffles the nonce range and distributes it across worker goroutines. Each worker sends the probe PNG with a candidate nonce and measures the response time.
When a response exceeds the adaptive threshold (the higher of -threshold-ms and baseline_p99 × outlier-mult), the candidate is re-probed -verify times. If a majority of re-probes also exceed the threshold, the nonce is confirmed. If not, the candidate is blacklisted and the scan continues. Up to 8 false-positive "blips" are tolerated before the scan gives up.
Reported to Bishop Fox through GitHub's private advisory process. CalebKingan wrote the patch.
-silent| false |
| Only print the discovered nonce to stdout |