CVE-2025-9242: WatchGuard IKE2 Stack Overflow RCE

#修改passwd
cd /mnt/firewall/etc
#创建个密文
openssl passwd -6 密码
#修改passwd中root的密码，注意!也要删去，否则无法使用root
sudo vim passwd
#保存并退出出
:wq
#看到root使用的ash，但实际系统中并没有任何shell，所以要回到bin目录，创建软连接
cd /mnt/firewall/bin
#查看busybox架构
file busybox-rel
#下载对应架构完整的busybox
sudo wget https://busybox.net/downloads/binaries/1.21.1/busybox-x86_64
#修改权限
sudo chmod 777 busybox-x86_64
#创建软链
sudo ln -s  busybox-x86_64 ash
#验证一下软链
sudo ls -al ash

#进入crack路径
cd ~/crack_firewall
#生成私钥
openssl ecparam -name sect163k1 -genkey -noout -out private_key.pem
#生成公钥
openssl ec -in private_key.pem -pubout -out public_key.pem
#修改pre-license中的version, wg name, licenses ， expiration dates
vim aftermarket_lic.txt
#生成license文件
python3 sign_feature_key.py aftermarket_lic.txt private_key.pem
#验证license文件
python3 verify_feature_key.py aftermarket_lic.txt public_key.pem
#替换公钥
sudo cp public_key.pem /mnt/firewall/etc/lickey.pem
#修改info.txt中的product=utm为product=base
sudo sed -i -e "s/Product = utm/Product = base/" /mnt/firewall/info.txt

Internet Security Association and Key Management Protocol
    Initiator SPI: aae76f3726073034
    Responder SPI: 0000000000000000
    Next payload: Security Association (33)
    Version: 2.0
    Exchange type: IKE_SA_INIT (34)
    Flags: 0x08 (Initiator, No higher version, Request)
    Message ID: 0x00000000
    Length: 548
    Payload: Security Association (33)
        Payload: Proposal (2) # 1
            Payload: Transform (3)
                Transform Type: Encryption Algorithm (ENCR) (1)
                Transform ID (ENCR): ENCR_AES_CBC (12)
                Transform Attribute (t=14,l=2): Key Length: 256
            Payload: Transform (3)
                Transform Type: Pseudo-random Function (PRF) (2)
                Transform ID (PRF): PRF_HMAC_SHA2_256 (5)
            Payload: Transform (3)
                Transform Type: Integrity Algorithm (INTEG) (3)
                Transform ID (INTEG): AUTH_HMAC_SHA2_256_128 (12)
            Payload: Transform (3)
                Transform Type: Diffie-Hellman Group (D-H) (4)
                Transform ID (D-H): 2048 bit MODP group (14)
    Payload: Key Exchange (34)
    Payload: Nonce (40)
    Payload: Notify (41) - NAT_DETECTION_DESTINATION_IP
    Payload: Notify (41) - NAT_DETECTION_SOURCE_IP
    Payload: Vendor ID (43) : Unknown Vendor ID
    Payload: Vendor ID (43) : Unknown Vendor ID
    Payload: Vendor ID (43) : Cisco Fragmentation
    Payload: Vendor ID (43) : Cisco Fragmentation
    Payload: Notify (41) - IKEV2_FRAGMENTATION_SUPPORTED
    Payload: Notify (41) - REDIRECT_SUPPORTED
    Payload: Notify (41) - SIGNATURE_HASH_ALGORITHMS

Internet Security Association and Key Management Protocol
    Initiator SPI: aae76f3726073034
    Responder SPI: f1b3cf883e18a45c
    Next payload: Encrypted and Authenticated (46)
    Version: 2.0
    Exchange type: IKE_AUTH (35)
    Flags: 0x08 (Initiator, No higher version, Request)
    Message ID: 0x00000001
    Length: 1616
    Payload: Encrypted and Authenticated (46)
        Initialization Vector: 57401bf413505f5550173a07d778d68f (16 bytes)
        Encrypted Data (1552 bytes) <AES-CBC-256 [RFC3602]>
        Decrypted Data (1552 bytes)
            Contained Data (1538 bytes)
                Payload: Identification - Initiator (35) <---
                    Payload length: 521
                    ID type: FQDN (2)
                    […] Identification Data:(A*513)      <---
                Payload: Certificate (37)                <---
                Payload: Notify (41) - INITIAL_CONTACT
                Payload: Notify (41) - HTTP_CERT_LOOKUP_SUPPORTED
                Payload: Certificate Request (38)
                Payload: Configuration (47)
                Payload: Security Association (33)
                Payload: Traffic Selector - Initiator (44) # 1
                Payload: Traffic Selector - Responder (45) # 1
                Payload: Vendor ID (43) : RFC 3706 DPD (Dead Peer Detection)
                Payload: Notify (41) - MOBIKE_SUPPORTED
                Payload: Notify (41) - MULTIPLE_AUTH_SUPPORTED
            Padding (13 bytes)
            Pad Length: 13
        Integrity Checksum Data: 3e2683f32beaaddeb8f3f0d43f7b0b2b (16 bytes) <HMAC_SHA2_256_128 [RFC4868]>[correct]

 // src/ike/iked/v2/ike2_payload_cert.c
 int ike2_ProcessPayload_CERT(uint8_t *pIkeSA, p_id_t *pIDPld)
 {
     char identification [520];
     memset(identification, 0, sizeof(identification));
     ...
 
     // Vulnerability: Stack-based buffer overflow
     // * pIDPld.identification is an attacker-controlled buffer
     // * identification is a fixed size stack buffer of 520 bytes
     memcpy(identification, pIDPld.identification.buffer, pIDPld.identification.length);
 
     ...
 
     int status = CMgrValidateCert_GetPubKey(...);
     if (status != 0)
         wglog_trace_r("failed to validate received peer certificate");
     wglog_trace_r("successfully validated received peer certificate");
 }

// src/ike/iked/v2/ike2_payload_cert.c
 int ike2_ProcessPayload_CERT(uint8_t *pIkeSA, p_id_t *pIDPld)
 {
     char identification [512];
     memset(identification, 0, sizeof(identification));
     ...

     // CVE-2025-9242 length check patch
     if (pIDPld.identification.length > 0x200)
     {
         wglog_trace_r("received ID data legth(%d) is larger than expected length",
             gProgram, pIDPld.identification.length);
         return -1;
     }
 
     memcpy(identification, pIDPld.identification.buffer, pIDPld.identification.length);
 
     ...
 
     int status = CMgrValidateCert_GetPubKey(...);
     if (status != 0)
         wglog_trace_r("failed to validate received peer certificate");
     wglog_trace_r("successfully validated received peer certificate");
 }