Microsoft Office XP – Remote code Execution
##################################################################################### Application: Microsoft Office XP Remote code Execution Platforms: Windows Vista Exploitation: Remote code execution CVE Number: Microsoft Bulletin: {PRL}: 2011-07 Author: Francis Provencher (Protek Research Lab's) WebSite: http://www.protekresearchlab.com/ Twitter: @ProtekResearch ##################################################################################### 1) Introduction 2) Report Timeline 3) Technical details 4) POC ##################################################################################### =============== 1) Introduction =============== Microsoft Office is a proprietary commercial office suite of inter-related desktop applications, servers and services for the Microsoft Windows and Mac OS X operating systems, introduced by Microsoft in 1989. Initially a marketing term for a bundled set of applications, the first version of Office contained Microsoft Word, Microsoft Excel, and Microsoft PowerPoint. Over the years, Office applications have grown substantially closer with shared features such as a common spell checker, OLE data integration and Microsoft Visual Basic for Applications scripting language. http://en.wikipedia.org/wiki/Microsoft_Office ##################################################################################### ============================ 2) Report Timeline ============================ 2011-01-03 - Vulnerability reported to vendor 2011-06-14 - Uncoordinated public release of advisory ##################################################################################### ==================== 3) Technical details ==================== This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. 0:000> g (c18.bf4): Access violation - code c0000005 (!!! second chance !!!) eax=41424344 ebx=00000011 ecx=00000010 edx=00000001 esi=00000000 edi=41424344 eip=308eb16d esp=00125450 ebp=00125474 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 winword!wdGetApplicationObject+0x150fac: 308eb16d 8b07 mov eax,dword ptr [edi] ds:0023:41424344=???????? ##################################################################################### =========== 4) POC =========== https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17399.doc (PRL-2011-07.doc) http://www.protekresearchlab.com/exploits/PRL-2011-07.doc |