Heap-based Buffer Overflow in FFmpeg http.c

This repository contains two Python exploit scripts targeting a vulnerability in ffmpeg, likely related to improper handling of AVIOContext structures when connecting to a malicious server. Both scripts use the pwntools library to set up a TCP listener on port 12345, simulating a server that ffmpeg will connect to. The main exploit (exploit.py) crafts a complex payload using ROP chains and custom shellcode to achieve remote code execution. Upon successful exploitation, the script delivers a reverse shell payload that connects back to the attacker's machine on 127.1.1.1:1337, granting remote shell access. The exploit requires the attacker to induce the victim's ffmpeg process to connect to their server, after which the exploit triggers a memory corruption, pivots the stack, sets up an executable memory region, writes shellcode, and executes it. The secondary script (exploit crash.py) appears to be a simpler version that triggers the crash and sends a large payload, likely for debugging or proof-of-crash purposes. No hardcoded CVE is referenced, but the exploit is clearly operational and weaponized for remote code execution against vulnerable ffmpeg instances.