Remote Code Execution in Ivanti Connect Secure, Policy Secure, and ZTA Gateways

This repository is a small lab-style stack buffer overflow simulation rather than a production exploit kit. It contains four files: a README with build guidance, exploit.py as the proof-of-concept client, vulnerable_server.c implementing the unsafe network service, and patched_server.c showing the remediated version. The vulnerable server listens on TCP port 9999, accepts up to 1024 bytes from a client, and passes the received data into vulnerable_function(), which copies it into a 256-byte stack buffer using strcpy without bounds checking. The exploit script connects to 127.0.0.1:9999 and sends a crafted payload consisting of 268 bytes of padding, a 4-byte EIP overwrite marker ('BBBB'), a short NOP sled, and 32 bytes of 0xCC INT3 instructions. This is designed for debugger-visible crash/control-flow validation, not post-exploitation. The patched server replaces strcpy with bounded strncpy and null termination, preserving the same network behavior while removing the overflow condition. Overall, the repository’s purpose is educational: demonstrate root cause, trigger conditions, and a basic exploit path for a stack-based overflow in a simplified embedded/firmware-like TCP service.

This repository is a self-contained lab simulation of a network-reachable stack-based buffer overflow, presented as a representative demo for CVE-2025-22457 rather than a real product exploit. The structure includes two pairs of C servers: a primary/demo pair (`meric_vulnerable_server.c` and `meric_patched_server.c`) and an older/simpler pair (`vulnerable_server.c` and `patched_server.c`). All servers implement a TCP service on port 9999; the vulnerable variants copy attacker-controlled network input into a 256-byte stack buffer without proper bounds checking (`strcpy`), while the patched variants add length checks or bounded copying. The main exploit capability is in `exploit.py`, which connects to `127.0.0.1:9999` and sends a classic overflow layout: 268 bytes of padding, a 4-byte EIP overwrite marker (`BBBB`), a short NOP sled, and placeholder INT3 bytes as demo shellcode. This indicates the exploit is intended to prove offset calculation and instruction-pointer control under a debugger, not to deliver a real post-exploitation payload. `crash_client.py` is a simpler companion tool that sends either a normal short string or a long repeated-character payload to demonstrate service stability versus crash behavior. The Makefile builds the `meric_*` server pair with insecure compilation settings suitable for a lab (`-fno-stack-protector`, `-no-pie`). The README files explain the educational purpose, compilation steps, and demo flow: start the vulnerable service, send benign traffic, send oversized traffic to trigger a segmentation fault, then compare behavior with the patched service. Overall, this is a genuine exploit/demo repository for a network attack vector, but it is clearly educational and local-lab oriented, with operational crash/EIP-control proof rather than weaponized remote code execution.

This repository contains a working exploit for CVE-2025-22457, a critical unauthenticated remote code execution vulnerability affecting Ivanti Connect Secure, Policy Secure, ZTA Gateways, and Pulse Connect Secure appliances. The exploit is implemented in Ruby (CVE-2025-22457.rb) and is accompanied by a detailed README.md explaining affected versions, exploitation steps, and mitigation advice. The exploit works by sending crafted HTTP/HTTPS requests to the target's web interface, fingerprinting the product version, and then performing a heap spray and buffer overflow attack against the /home/bin/web process, leveraging ROP gadgets in /home/lib/libdsplibs.so. The attacker must provide their own IP and port for the reverse shell payload, which is a standard bash reverse shell. The exploit brute-forces the base address of the target library unless provided directly, and can be tuned for the number of web child processes on the appliance. The code is operational and provides a real reverse shell if successful, but requires the attacker to have network access to the target's HTTPS port and to set up a listener. The exploit is not part of a framework and is a standalone PoC with a customizable payload. The endpoints targeted are the Ivanti web interface and specific internal files/processes on the appliance.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-22457, a remote unauthenticated stack-based buffer overflow affecting Ivanti Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways (version 22.7r2.4). The main exploit is implemented in Ruby (CVE-2025-22457-main/CVE-2025-22457.rb) and leverages a network-based attack vector over HTTPS. The exploit works by brute-forcing the base address of a shared library (libdsplibs.so) and performing heap spraying to ensure reliable exploitation across multiple web child processes. Upon successful exploitation, the script executes a user-supplied payload (default: a bash reverse shell) on the target, granting remote shell access as the 'nr' user. The repository includes detailed usage instructions, debugging tips, and information about the target environment. No detection scripts or fake code are present; this is a functional PoC exploit.

This repository contains a single Metasploit module targeting a stack-based buffer overflow vulnerability (CVE-2025-22457) in Ivanti Connect Secure (versions 22.7R2.5 and earlier) running on Linux. The exploit is unauthenticated and leverages a heap spray and brute-force approach to bypass ASLR and achieve remote code execution. The module interacts with the target's web interface over HTTPS (default port 443), first checking the product version via a GET request to '/dana-na/auth/url_admin/welcome.cgi'. If the target is vulnerable, the module attempts to exploit the buffer overflow by brute-forcing the base address of the 'libdsplibs' library, spraying memory, and triggering the overflow to execute a command shell payload (default: Meterpreter reverse shell). The exploit is operational and provides a remote shell if successful. The code is structured as a standard Metasploit module, with options for thread count, brute-force attempts, and target-specific parameters. No hardcoded IPs or domains are present; the module is designed to be used against user-specified targets.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-22457, a remote unauthenticated stack-based buffer overflow in Ivanti Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateway appliances (specifically version 22.7.2.3597). The exploit is implemented in Ruby (CVE-2025-22457.rb) and is designed to achieve remote code execution by sending crafted HTTPS requests to the target's web interface. The exploit brute-forces the base address of a shared library (libdsplibs.so) to construct a ROP chain, ultimately executing a user-supplied shell command (by default, a bash reverse shell). The attacker must provide the target's IP, port, and their own listener IP/port. The exploit includes options to tune the number of web child processes and the base address for more efficient exploitation. The ReadMe.md provides detailed usage instructions, expected results (reverse shell as 'nr' user), and technical background. The main attack vector is network-based, targeting the HTTPS service on the appliance. Notable endpoints include the version fingerprinting CGI and the use of internal binaries and libraries for exploitation.