[NT] Visual Studio Code Execution (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Visual Studio Code Execution (Exploit)
------------------------------------------------------------------------


SUMMARY

Microsoft <http://msdn.microsoft.com/vstudio/> Visual Studio is "an
advanced integrated development environment by Microsoft. It lets
programmers create programs that run on Microsoft Windows and the World
Wide Web".

Microsoft Visual Studio has been designed to execute part of the user
provided code when it displays Form containing UserControls. The malicious
code will be executed automatically whenever the solution file is opened
in Visual Studio.

DETAILS

Vulnerable Systems:
* Visual Studio 2005

If a UserControl is added to a Form, Visual Studio will launch the code
inside UserControl_Load function automatically whenever the user decides
to view the main form where the UserControl is located. The execution
occurs with no warning, and doesn't require the viewer to compile or
execute the project.

Exploit:
<http://www.priestmaster.org/projects/exploits/vsexploit.zip>
http://www.priestmaster.org/projects/exploits/vsexploit.zip

Proof of concept:
Open vbexploit.sln file
Click on Form1.cs

If a user click on the solution file (vbexploit.sln) and the form1.cs is
shown, VS launch the code inside UserControl1_Load function. Place your
backdoor into this function (You can use the whole WIN-API and .NET
framework to code your back door). The default behavior for the example
file is show a Message Box and launch calc.exe.


ADDITIONAL INFORMATION

The information has been provided by <mailto:priest@xxxxxxxxxxxxxxxx>
priestmaster.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Defeating Microsoft Windows XP SP2 Heap Protection and DEP Bypass
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... and bypassing DEP (Data Execution Prevention). ... Buffer overrun attacks are among the most common mechanisms, or vectors, ... a long string to an input stream or control longer than the memory ...
    (Securiteam)
  • [NT] Windows VDM #UD Local Privilege Escalation
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... vulnerability to fully compromise a Windows NT 4.0, Windows 2000, Windows ... 32-bit VDM "host" code, and the invalid opcode fault handler within the ... process).The kernel does not validate the address to which execution is ...
    (Securiteam)
  • [UNIX] Rssh and Scponly Arbitrary Command Execution
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... are designed to allow execution only of certain preset programs. ... command execution on the remote host is possible. ... rssh allows any of five predefined programs to be executed on the remote ...
    (Securiteam)
  • [NEWS] ClamAV libclamav MEW PE File Integer Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ClamAV libclamav MEW PE File Integer Overflow Vulnerability ... Remote exploitation of an integer overflow vulnerability in Clam ... Exploitation of this vulnerability results in the execution of arbitrary ...
    (Securiteam)
  • [NT] Microsoft Windows Task Scheduler .job Stack Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... code execution flow to an address of their choosing. ... executed by exploiting this flaw will be run with the privileges of the ... In the case of Internet Explorer, ...
    (Securiteam)