0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
MS Internet Explorer / MSN ICC Profiles Crash PoC Exploit
[========================================================= MS Internet Explorer / MSN ICC Profiles Crash PoC Exploit ========================================================= */-----------------------------edwardgagnon--------------/* Can crash msn and execute commands Windows has a buffer overflow vulnerability in the processing of embedded ICC Profiles inside images (jpeg, tiff, etc...) To test - create a jpeg in adobe photoshop and save it with the ICC checkbox enabled, make sure you set it to RGB (that does not really matter, just so you can find which bytes to change for the test). Open in a hex editor and search for "RGB XYZ " (no quotes, case sensitive) You are now inside the header of the ICC Profile which is 128 bytes. 104 bytes away is a 4 byte number which is the Tag Count of the ICC Profile. Change this to "FF FF FF FF" (it will be followed by a 4 byte string which is part of a 12 byte tag. there are several such tags, it should help you identify which bytes to change). Save, open in internet explorer, and see the crash. and this is the crash: CODE .text:73B323BC loc_73B323BC: ; CODE XREF: GetColorProfileElement+D6j .text:73B323BC cmp [ebx], eax .text:73B323BE jz short loc_73B323DD .text:73B323C0 add ebx, 0Ch .text:73B323C3 inc edx .text:73B323C4 cmp edx, ecx .text:73B323C6 jb short loc_73B323BC .text:73B323C8 .text:73B323C8 loc_73B323C8: ; CODE XREF: GetColorProfileElement+CAj .text:73B323C8 push 7DCh ; dwErrCode .text:73B323CD call ds:SetLastError ebx is controlable. but gets a read access violation. ....be kool and create a PoC and change your sig to the exploit.jpg # 0day.today [2024-12-25] #