DATABASE RESOURCES PRICING ABOUT US

{"id": "EDB-ID:18067", "vendorId": null, "type": "exploitdb", "bulletinFamily": "exploit", "title": "Microsoft Excel 2007 SP2 - Buffer Overwrite (MS11-021)", "description": "", "published": "2011-11-02T00:00:00", "modified": "2011-11-02T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.exploit-db.com/exploits/18067", "reporter": "Abysssec", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2022-08-16T09:08:19", "viewCount": 9, "enchantments": {"score": {"value": 0.1, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.1}, "_state": {"dependencies": 1661182887, "score": 1661184847, "epss": 1678791570}, "_internal": {"score_hash": "592e5008857937291b7c95b312f18fb8"}, "sourceHref": "https://www.exploit-db.com/download/18067", "sourceData": "Abysssec Research\r\n\r\n1) Advisory information\r\n\r\n Title : Microsoft Excel 2007 SP2 Buffer Overwrite\r\nVulnerability\r\n Analysis : Abysssec.com\r\n Vendor : http://www.microsoft.com\r\n Impact : Critical\r\n Contact : info [at] abysssec.com\r\n Twitter : @abysssec\r\n\r\nMicrosoft :\r\nA remote code execution vulnerability exists in the way that Microsoft\r\nExcel handles specially crafted Excel files.\r\nAn attacker who successfully exploited this vulnerability could take\r\ncomplete control of an affected system.\r\nAn attacker could then install programs; view, change, or delete data;\r\nor create new accounts with full user rights.\r\n\r\n\r\neach excel file can contain multiple BOF (2057) records . This record\r\nspecifies the first substream associated with workbook.\r\nOne of the fields in these records, specify substream recordd to come\r\nwith. This field can be extracted from sub_3018F0C2 function.\r\n\r\n.text:301A0C87 push [ebp+arg_2C]\r\n.text:301A0C8A mov ecx, [ebp+var_14]\r\n.text:301A0C8D push 1\r\n.text:301A0C8F call sub_3018F0C2\r\n.text:301A0C94 mov ecx, eax\r\n.text:301A0C96 mov eax, [ebp+arg_24]\r\n.text:301A0C99 cmp eax, ebx\r\n.text:301A0C9B mov [ebp+var_10], ecx\r\n.text:301A0C9E jz short loc_301A0CA2\r\n.text:301A0CA0 mov [eax], ecx\r\n\r\n\r\nIf the field value is equal with 400, sub_3019DFBA function is called to\r\ncheck file type. if file type is xls EXCEL.exe will display a message If\r\napproved it will continue to run the code.if you change file extension\r\nto xlb there will be any message. After this step sub_3053F626 function\r\nwill be executed. This function will parse the next BOF records.\r\n\r\n.text:304D4E9D cmp [ebp+arg_20], ebx\r\n.text:304D4EA0 jnz short loc_304D4EC6\r\n.text:304D4EA2 test dword ptr word_30EDCF9C, 2000000h\r\n.text:304D4EAC jnz short loc_304D4EC6\r\n.text:304D4EAE mov edx, [ebp+arg_C]\r\n.text:304D4EB1 mov ecx, [ebp+arg_8]\r\n.text:304D4EB4 push 3Fh\r\n.text:304D4EB6 call sub_3019DFBA\r\n.text:304D4EBB cmp eax, ebx\r\n.text:304D4EBD mov [ebp+var_8], eax\r\n.text:304D4EC0 jz loc_304D4FD3\r\n.text:304D4EC6\r\n.text:304D4EC6 loc_304D4EC6: ; CODE XREF:\r\nsub_301A0BC7+3342D9j\r\n.text:304D4EC6 ;\r\nsub_301A0BC7+3342E5j\r\n.text:304D4EC6 push ebx\r\n.text:304D4EC7 push dword_30EB89A4\r\n.text:304D4ECD push [ebp+var_C]\r\n.text:304D4ED0 call sub_3053F626\r\n.text:304D4ED5 cmp dword_30F5E64C, ebx\r\n.text:304D4EDB mov [ebp+var_8], eax\r\n.text:304D4EDE jz short loc_304D4EE7\r\n.text:304D4EE0 cmp eax, ebx\r\n.text:304D4EE2 jz short loc_304D4EE7\r\n\r\none of records may come after BOF,is undocumented record which have\r\nrecord type equal to 0xA7 (167).\r\nfor truly parsing this record should come with another record with 0x3C\r\n(60) record type. if it meet this requirement\r\nthe length of records will be read and copied to the stack.\r\n\r\nthe function which operation of copying data records in the stack is\r\nsub_30199E55. This function takes three arguments.\r\nThe first argument specifies the number of bytes to copy, which will\r\nread from file. The second argument specifies the\r\ndestination of the copy and the third argument specifies the maximum\r\namount of data can be copied. values of the second\r\nand third arguments based on the amount of computing reading from file\r\nand into this cumpoting,computational error which may occur here ...\r\n\r\n\r\n.text:3053F830 call sub_301A0A01\r\n.text:3053F835 cmp eax, 3Ch\r\n.text:3053F838 mov [ebp+var_ED4], eax\r\n.text:3053F83E jnz loc_30540488\r\n.text:3053F844 call sub_301A0A01\r\n.text:3053F849 mov ecx, [ebp+var_EDC]\r\n.text:3053F84F imul ecx, [ebp+var_F00]\r\n.text:3053F856 mov edi, eax\r\n.text:3053F858 mov eax, [ebp+var_EE0]\r\n.text:3053F85E lea ebx, [ecx+eax+3]\r\n.text:3053F862 call sub_301A0ABE\r\n.text:3053F867 push 0FFFFFFFDh\r\n.text:3053F869 pop edx\r\n.text:3053F86A sub edx, ecx\r\n.text:3053F86C add eax, edx\r\n.text:3053F86E push eax ; Dst\r\n.text:3053F86F push ebx ; int\r\n.text:3053F870 mov eax, edi\r\n.text:3053F872 call sub_30199E55\r\n\r\n\r\n\r\n the vulnerability that exists here is that we can change the value of\r\nparameter 3 whith our own values.\r\n program will not correcly controll third argument of sub_30199E55 this\r\nand can result in the desired\r\n amount and location of desired data can overwrite in the stack.\r\n\r\n.text:30199E60 cmp edi, [esp+4+Dst]\r\n.text:30199E64 ja loc_303EE1B7\r\n.text:30199E6A mov ecx, [esp+4+arg_0]\r\n.text:30199E6E push ebx\r\n.text:30199E6F mov ebx, dword_30F726C0\r\n.text:30199E75 push ebp\r\n.text:30199E76 mov ebp, nNumberOfBytesToRead\r\n.text:30199E7C push esi\r\n.text:30199E7D mov [esp+10h+Dst], ecx\r\n....\r\n.text:30199E93 mov eax, [esp+10h+Dst]\r\n.text:30199E97 push esi ; Size\r\n.text:30199E98 lea edx, dword_30F6E6B8[ebx]\r\n.text:30199E9E push edx ; Src\r\n.text:30199E9F push eax ; Dst\r\n.text:30199EA0 sub edi, esi\r\n.text:30199EA2 call memcpy\r\n.text:30199EA7 add [esp+1Ch+Dst], esi\r\n.text:30199EAB add ebx, esi\r\n.text:30199EAD add esp, 0Ch\r\n.text:30199EB0 test edi, edi\r\n.text:30199EB2 mov dword_30F726C0, ebx\r\n.text:30199EB8 jnz loc_301E0DB3\r\n\r\n\r\nExploiting :\r\n\r\nStack overflows are not hard to exploit at all ! but as we have both /GS\r\n, SAFESEH here.\r\nbecause given that we are destined to memcpy we can change it so that it\r\nbegins to overwrite the stack after GS.\r\nand from there when the return comes , our values contained in the ESP\r\nand we can call it with simple call esp and game is over !!!\r\n\r\nexploit can be download from here :\r\n\r\nhttp://www.abysssec.com/blog/wp-content/uploads/2011/11/MS11-021.zip\r\n\r\nEDB mirror :\r\n\r\nhttps://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/18067.zip", "osvdbidlist": [], "exploitType": "local", "verified": true}

{}