CVE-2017-0038 PoC — Microsoft Windows 安全漏洞

Source

https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS

Associated Vulnerability

Title: Microsoft Windows 安全漏洞 (CVE-2017-0038)
Description:gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.

Readme

# CVE-2017-0038-EXP-C-JS

详细漏洞分析和Exploit编写过程已经发表在安全客上：
http://bobao.360.cn/learning/detail/3644.html

C Exploit中，少一个printf打印最后的color数组，可以自行添加，也可直接用debug调试观察内存泄露

JS Exploit已经更新一个可以直接打印bitmap的版本

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →