CVE-2007-4776
published 2007-09-10CVE-2007-4776: Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic…
PriorityP352critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
48.96%
98.7th percentile
Buffer overflow in Microsoft Visual Basic 6.0 and Enterprise Edition 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a Visual Basic project (vbp) file containing a long Reference line, related to VBP_Open and OLE. NOTE: there are limited usage scenarios under which this would be a vulnerability.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_basic | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandReference=*\G{00020430-0000-0000-C000-000000000046}#2.0#0#..\..\..\..\WINNT\System32\stdole2.tlb#OLE Automation↗
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36
- →Trigger is a .VBP file with an abnormally long 'Reference=' line (overflow occurs at ~494-496 bytes into the Reference value); monitor file-open events for Visual Basic 6.0 (VBP_Open) processing oversized Reference lines. ↗
- →The malicious VBP file always contains a Reference line pointing to stdole2.tlb via a deep relative path traversal (../../../../WINNT/System32/stdole2.tlb or similar) followed by the overflow payload; flag VBP files whose Reference= value exceeds ~494 characters. ↗
- →The return address used in the Metasploit module targets a gadget inside VBSCC.DLL (call ESP, 0x37178B60); presence of this address in a crash context or memory scan indicates exploitation of this CVE. ↗
- →The Koshi/original PoC uses a 'jmp ebp' gadget from ntdll.dll at 0x7C923DA3 (Windows XP SP2 English); this return address in an exception context is a strong indicator of exploitation. ↗
- →Bad characters for payload are null byte, LF, CR, and space (\x00\x0a\x0d\x20); shellcode in exploit files will avoid these bytes — use this constraint when writing YARA rules for payload detection inside VBP files. ↗
- →Payload space is constrained to 650 bytes with a stack adjustment of -3500; look for large blocks of alphanumeric-encoded shellcode immediately following the Reference= overflow padding in a VBP file. ↗
- ·Return addresses are OS/SP/locale-specific; the Metasploit module only targets Windows XP SP2 English, while the Perl PoC lists multiple ntdll.dll gadget addresses for XP SP1/SP2, Win2000, and Win2003 in various locales — detections relying on specific return addresses will miss other configurations. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft Visual Basic - '.VBP' Local Buffer Overflow (Metasploit)
exploitdb·2010-09-25
CVE-2007-4776 Microsoft Visual Basic - '.VBP' Local Buffer Overflow (Metasploit)
Microsoft Visual Basic - '.VBP' Local Buffer Overflow (Metasploit)
---
##
# $Id: ms_visual_basic_vbp.rb 10477 2010-09-25 11:59:02Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Microsoft Visual Basic VBP Buffer Overflow',
'Description' => %q{
This module exploits a stack oveflow in Microsoft Visual
Basic 6.0. When a specially crafted vbp file containing a long
reference line, an attacker may be able to execute arbitrary
code.
},
'License' => MSF_LICENSE,
'Author' => [ 'MC' ],
'Version' => '$Revision: 10477 $',
'References' =>
[
[ 'CV
Exploit-DB
Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution
exploitdb·2007-09-19
CVE-2007-4776 Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution
Microsoft Visual Basic Enterprise 6.0 SP6 - Code Execution
---
#usage: vbexploit.py FileName.vbp
import sys
print "--------------------------------------------------------------------------"
print " [PoC_2] Microsoft Visual Basic Enterprise Edition 6.0 SP6 Code Execution "
print " author: shinnai"
print " mail: shinnai[at]autistici[dot]org"
print " site: http://shinnai.altervista.org\n"
print " based on Koshi exploit"
print " http://www.milw0rm.com/exploits/4361\n"
print " I try his exploit on Windows XP Pro SP2 Ita, full patched and it doesn't"
print " work, but he said:\n"
print ' "# ...backwards..if you don' + "'t" + ' know why, then gtfo."\n'
print " ok, now I know why brotha, I got this exception:\n"
print ' "Access violation when writing to [63636363]"\n'
print " so I search anot
Exploit-DB
Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec
exploitdb·2007-09-04
CVE-2007-4776 Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec
Microsoft Visual Basic 6.0 - VBP_Open OLE Local CodeExec
---
#!/usr/bin/perl
#' ++ Microsoft Visual Basic 6.0 Code Execution 0-Day ++
#' ++++++++++++++++++++++++++++++++++++++++++++++++++++++
#'++ Author: Koshi +
#'++ Email: heykoshi at gmail dot com +
#'++ Application: Microsoft Visual Basic 6.0 +
#'++ +
#'++ Tested on Microsoft Windows XP Home Edition SP2 +
#'++ Patched & Updated +
#'++ +
#'++ The vulnerable buffer exsists in the .VBP files of +
#'++ Visual Basic projects. You can jump directly to +
#'++ the shellcode, or jump to it via EBP. +
#'++ +
#'++ There is NO restriction of shellcode size either. +
#'++ +
#'++ Gr33tz: Rima my baby who I love and adore, Draven +
#'++ for pointing me in the right direction, as always. +
#'++ +
#'++ +
#'++ This exploit is for educational use only,
Metasploit
Microsoft Visual Basic VBP Stack Buffer Overflow
metasploit
Microsoft Visual Basic VBP Stack Buffer Overflow
Microsoft Visual Basic VBP Stack Buffer Overflow
This module exploits a stack buffer overflow in Microsoft Visual Basic 6.0. A specially crafted Visual Basic Project (VBP) file containing a long reference line can be used to execute arbitrary code.
No writeups or analysis indexed.
http://secunia.com/advisories/26704http://www.osvdb.org/36936http://www.securityfocus.com/bid/25629http://www.securitytracker.com/id?1018676https://www.exploit-db.com/exploits/4361https://www.exploit-db.com/exploits/4431http://secunia.com/advisories/26704http://www.osvdb.org/36936http://www.securityfocus.com/bid/25629http://www.securitytracker.com/id?1018676https://www.exploit-db.com/exploits/4361https://www.exploit-db.com/exploits/4431
2007-09-10
Published