CPython zipimport Integer Overflow Heap Buffer Overflow

This repository provides a proof-of-concept (PoC) exploit for CVE-2016-5636, a heap overflow vulnerability in Python 3.6's zipimport module. The repository is organized into several directories: - crash-with-zip: Contains scripts to generate a malicious zip file (import.zip) with a large payload (payload.txt) and a runner script (run.py) that loads the zip file using zipimport.zipimporter, triggering the heap overflow. The Makefile and run_exploit.sh automate the process. - google-web-engine: Contains a Flask-based skeleton app for Google App Engine, with a script (gen_import.py) to generate a similar malicious zip file in the templates directory. This demonstrates the exploit in a cloud environment. - The rest of the repository includes third-party Python libraries (Flask, Jinja2, Werkzeug, MarkupSafe) and extensive test suites, which are not directly related to the exploit but are part of the App Engine skeleton. The exploit demonstrates a denial-of-service (crash) scenario by causing a heap overflow when a vulnerable Python interpreter processes the crafted zip file. No remote code execution is provided, but the attack vector could be local (user opening a malicious zip) or network-based (if a web service processes untrusted zip files). The main fingerprintable endpoints are the crafted zip files and payloads. The exploit is a PoC and does not include weaponized payloads.