Understanding the SlimPDF Reader 1.0 Memory Corruption Exploit

What this paper is

This paper details a memory corruption vulnerability found in SlimPDF Reader version 1.0. The vulnerability can be triggered by a specially crafted PDF file, leading to a denial-of-service (DoS) condition. The exploit provided demonstrates how to create such a PDF file to crash the application.

Simple technical breakdown

The core of the vulnerability lies in how SlimPDF Reader handles malformed PDF files. When processing a PDF, the application likely attempts to read data from a buffer. By providing an excessively large amount of data followed by a specific marker (startxref), the program can be tricked into writing data beyond the allocated buffer's boundaries. This overwrites adjacent memory, corrupting the program's state and causing it to crash.

Complete code and payload walkthrough

The provided Python script generates a malicious PDF file. Let's break down the code:

payload ="A"*10000
crash="startxref"
pdf=payload+crash

filename = "slimpdPoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close()

• payload ="A"*10000:

  • Purpose: This line creates a string consisting of 10,000 repetitions of the character 'A'. This long string of 'A's is intended to overflow a buffer within the SlimPDF Reader application.
  • Practical Purpose: Acts as the primary data that will be written out of bounds.

• crash="startxref":

  • Purpose: This line defines a specific string, "startxref". In PDF file structure, startxref typically indicates the byte offset from the beginning of the file to the start of the cross-reference table.
  • Practical Purpose: This string serves as a trigger. When the parser encounters this string after the overflowing payload, it likely causes an unexpected state or attempt to process invalid data, leading to the crash.

• pdf=payload+crash:

  • Purpose: This concatenates the payload string and the crash string. The resulting pdf string is the complete content that will be written into the malicious PDF file.
  • Practical Purpose: Combines the overflow data with the trigger to form the exploit's content.

• filename = "slimpdPoC.pdf":

  • Purpose: Assigns the name "slimpdPoC.pdf" to the file that will be created.
  • Practical Purpose: Defines the output filename for the exploit.

• file = open(filename,"w"):

  • Purpose: Opens a file with the specified filename in write mode ("w"). If the file exists, its contents will be erased.
  • Practical Purpose: Prepares to write the exploit content to a file.

• file.writelines(pdf):

  • Purpose: Writes the entire content of the pdf string (the overflowed payload and the startxref marker) into the opened file.
  • Practical Purpose: Populates the PDF file with the malicious data.

• file.close():

  • Purpose: Closes the file, ensuring that all buffered data is written to disk and releasing the file handle.
  • Practical Purpose: Finalizes the creation of the exploit PDF.

Mapping list:

• payload ="A"*10000 -> Overflow Data: Provides the excessive input to trigger memory corruption.
• crash="startxref" -> Trigger String: Signals an invalid or unexpected structure to the PDF parser, leading to the crash.
• pdf=payload+crash -> Exploit Content: The combined data that forms the malicious PDF.
• filename = "slimpdPoC.pdf" -> Output Filename: The name of the generated exploit file.
• file = open(filename,"w") -> File Handling: Opens the target file for writing.
• file.writelines(pdf) -> Content Writing: Writes the exploit data into the file.
• file.close() -> File Finalization: Closes and saves the exploit file.

Shellcode/Payload Segment Explanation:

There is no explicit shellcode or multi-stage payload in the traditional sense within this specific exploit script. The "payload" here is simply a large block of 'A' characters designed to cause a buffer overflow, leading to a denial-of-service (crash) of the application. The startxref string acts as a marker that, when processed by the vulnerable PDF parser, triggers the crash. This is a classic DoS exploit.

Practical details for offensive operations teams

• Required Access Level: No elevated privileges are required on the target system to create the malicious PDF. However, to deliver and execute the exploit (i.e., get the victim to open the PDF), standard user access or social engineering would be necessary.
• Lab Preconditions:
  • A vulnerable instance of SlimPDF Reader 1.0 installed on a Windows 7 machine.
  • A Python interpreter to run the exploit script.
  • The exploit script itself.
• Tooling Assumptions:
  • Python 2.x or 3.x for script execution.
  • A text editor for viewing/modifying the script.
• Execution Pitfalls:
  • Incorrect Version: The exploit is specific to SlimPDF Reader 1.0. Newer versions or other PDF readers will not be affected.
  • File Association: The victim must open the generated .pdf file with the vulnerable SlimPDF Reader. If another reader is the default, the exploit will not work.
  • Antivirus/EDR: While this specific exploit is a DoS and doesn't involve malicious code execution, the creation of a file with unusual content could potentially be flagged by some security software, though it's less likely for a simple DoS.
  • PDF Parsing Variations: Different PDF parsers might handle malformed data differently. The startxref marker's effectiveness depends on the specific parsing logic of SlimPDF Reader 1.0.
  • Buffer Size: The 10000 'A's might need adjustment. If the buffer is smaller or larger than anticipated, the overflow might not occur, or it might cause a different type of error.

Where this was used and when

• Context: This exploit was published in June 2012. It targets a specific vulnerability (CVE-2011-4220) in SlimPDF Reader 1.0.
• Usage: Such exploits are typically used in penetration testing engagements or by malicious actors to disrupt services or gather intelligence by observing system behavior after a crash. The primary impact here is a Denial of Service.
• Approximate Years/Dates: The vulnerability was likely discovered and published around 2011-2012. Its practical use would have been during that period and shortly after, before patches or software updates mitigated it.

Defensive lessons for modern teams

• Software Updates: Regularly update all software, especially applications that handle untrusted file formats like PDFs. This vulnerability was patched by updating the software.
• Input Validation: Developers must rigorously validate all input, especially data from external sources. This includes checking buffer sizes and expected data formats.
• Memory Safety: Employ memory-safe programming practices and languages where possible to reduce the likelihood of buffer overflows.
• Sandboxing: Run applications that process untrusted files in sandboxed environments. This limits the impact of a crash or potential exploit to the sandbox, not the entire system.
• Intrusion Detection/Prevention: While this specific exploit is a DoS, network and host-based security systems can detect unusual file creation patterns or application crashes that might indicate an attempted exploit.

ASCII visual (if applicable)

This exploit is a simple file-based DoS, so a complex architectural diagram isn't strictly necessary. However, we can visualize the data flow:

+-----------------+      +----------------------+      +--------------------+
| Exploit Script  |----->| Malicious PDF File   |----->| SlimPDF Reader 1.0 |
| (Python)        |      | (slimpdPoC.pdf)      |      | (Vulnerable)       |
+-----------------+      +----------------------+      +--------------------+
                         |                      |
                         | "A"*10000 + "startxref" |
                         +----------------------+
                                    |
                                    V
                            +---------------+
                            | Application   |
                            | CRASH (DoS)   |
                            +---------------+

Source references

• Paper ID: 19391
• Paper Title: Slimpdf Reader 1.0 - Memory Corruption
• Author: Carlos Mario Penagos Hollmann
• Published: 2012-06-25
• Keywords: Windows, dos
• Vendor Homepage: www.investintech.com
• Version: 1.0
• Tested on: Windows 7
• CVE: cve-2011-4220
• Exploit-DB URL: https://www.exploit-db.com/papers/19391

Original Exploit-DB Content (Verbatim)

# Exploit Title:
# Date: June 24 2012
# Exploit Author: Carlos Mario Penagos Hollmann
# Vendor Homepage: www.investintech.com
# Version:1.0
# Tested on: Windows 7
# CVE : cve-2011-4220


payload ="A"*10000
crash="startxref"
pdf=payload+crash

filename = "slimpdPoC.pdf"
file = open(filename,"w")
file.writelines(pdf)
file.close()