# CVE-2025-5777 Exploit Tool 🔥
A powerful **educational tool** designed to demonstrate and analyze the vulnerability **CVE-2025-5777** affecting Citrix NetScaler VPN.
This project is part of the [GO-TO CVE](https://t.me/GOTOCVE) initiative.
> ⚠️ **For educational purposes only. Do NOT use this on systems you don't own or have explicit permission to test.**
---
## 📌 About
This script attempts to detect and extract sensitive internal tokens, internal IPs, and hidden endpoint paths exposed by vulnerable Citrix VPN endpoints.
It's built to help students, security researchers, and red teamers better understand how real-world CVEs are discovered and analyzed.
---
## 🚀 Features
- Async-based fast scanning
- Extracts leaked authentication tokens
- Finds hidden/internal VPN paths
- Easy to use, fast results
- Clean JSON output (optional)
---
## 📦 Installation
```bash
git clone https://github.com/soltanali0/CVE-2025-5777-Exploit.git
cd CVE-2025-5777-Exploit
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
````
> Requires Python 3.8+
> Optional: You can use a virtual environment
## 🛠 Usage
```bash
python3 exploit.py https://target-vpn.com
```
* Add `--proxy http://127.0.0.1:8080` to route through Burp/SOCKS
* Add `--silent` to suppress output
* Add `--output result.json` to save to JSON
Example:
```bash
python3 exploit.py https://20.237.190.100 --output leaks.json
```
---
## 📁 Output Sample and nuceli Sample
<img width="1127" height="167" alt="image" src="https://github.com/user-attachments/assets/0a4301af-679a-4f41-a774-1ff4f6e68b10" />
```
[!] Leak analysis:
→ Tokens found: ZWZlNjViZDA4NThj...
→ Paths found: /nf/auth/doLogoff.do, /nf/auth/doEPA.do, /Credential
```
and
<img width="1127" height="256" alt="image" src="https://github.com/user-attachments/assets/4089aaa3-52d4-4dd1-ac40-426a721fa204" />
---
## ✅ Prevention Tips
To avoid exploitation of this CVE:
* Sanitize all user inputs on the Citrix VPN front-end.
* Restrict access control to any public path added manually.
* Apply Citrix's latest security patches.
---
## 📚 Legal & Disclaimer
This tool is released **strictly for educational and lawful research purposes**.
The developer takes **no responsibility** for any misuse or illegal activity conducted using this code.
By using this tool, you agree that:
* You will use it only in labs or authorized environments
* You accept all liability for any damages caused by misuse
---
## 📡 Telegram Channel
Join the CVE leak and exploit research community:
👉 **[https://t.me/GOTOCVE](https://t.me/GOTOCVE)**
---
## ✍️ Author
Developed by `Ali Soltani` – red teamer and CVE hunter.
Proudly part of the GO-TO CVE
登录后查看神龙缓存的 POC 文件快照
登录查看