CVE-2025-5777 PoC — NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Readme

# CVE-2025-5777 Exploit Tool 🔥

A powerful **educational tool** designed to demonstrate and analyze the vulnerability **CVE-2025-5777** affecting Citrix NetScaler VPN.  
This project is part of the [GO-TO CVE](https://t.me/GOTOCVE) initiative.

> ⚠️ **For educational purposes only. Do NOT use this on systems you don't own or have explicit permission to test.**

---

## 📌 About

This script attempts to detect and extract sensitive internal tokens, internal IPs, and hidden endpoint paths exposed by vulnerable Citrix VPN endpoints.

It's built to help students, security researchers, and red teamers better understand how real-world CVEs are discovered and analyzed.

---

## 🚀 Features

- Async-based fast scanning
- Extracts leaked authentication tokens
- Finds hidden/internal VPN paths
- Easy to use, fast results
- Clean JSON output (optional)

---

## 📦 Installation

```bash
git clone https://github.com/soltanali0/CVE-2025-5777-Exploit.git
cd CVE-2025-5777-Exploit

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
````

> Requires Python 3.8+
> Optional: You can use a virtual environment

## 🛠 Usage

```bash
python3 exploit.py https://target-vpn.com
```

* Add `--proxy http://127.0.0.1:8080` to route through Burp/SOCKS
* Add `--silent` to suppress output
* Add `--output result.json` to save to JSON

Example:

```bash
python3 exploit.py https://20.237.190.100 --output leaks.json
```

---

## 📁 Output Sample and nuceli Sample

<img width="1127" height="167" alt="image" src="https://github.com/user-attachments/assets/0a4301af-679a-4f41-a774-1ff4f6e68b10" />


```
[!] Leak analysis:
    → Tokens found: ZWZlNjViZDA4NThj...
    → Paths found: /nf/auth/doLogoff.do, /nf/auth/doEPA.do, /Credential
```
and 

<img width="1127" height="256" alt="image" src="https://github.com/user-attachments/assets/4089aaa3-52d4-4dd1-ac40-426a721fa204" />


---

## ✅ Prevention Tips

To avoid exploitation of this CVE:

* Sanitize all user inputs on the Citrix VPN front-end.
* Restrict access control to any public path added manually.
* Apply Citrix's latest security patches.

---

## 📚 Legal & Disclaimer

This tool is released **strictly for educational and lawful research purposes**.
The developer takes **no responsibility** for any misuse or illegal activity conducted using this code.

By using this tool, you agree that:

* You will use it only in labs or authorized environments
* You accept all liability for any damages caused by misuse

---

## 📡 Telegram Channel

Join the CVE leak and exploit research community:
👉 **[https://t.me/GOTOCVE](https://t.me/GOTOCVE)**

---

## ✍️ Author

Developed by `Ali Soltani` – red teamer and CVE hunter.
Proudly part of the GO-TO CVE

File Snapshot

Remarks