Windows Shell Graphics Processing Overrun Vulnerability

This repository contains a single Metasploit module (ms11_006_createsizeddibsection.rb) that exploits a stack-based buffer overflow vulnerability (CVE-2010-3970, MS11-006) in the handling of thumbnail images within Microsoft Office documents and .MIC files on vulnerable Windows systems. The exploit works by generating a specially crafted file (default name: msf.doc) with a malformed bitmap header (specifically, a negative 'biClrUsed' value) embedded in the SummaryInformation stream of an OLE document. When a user views the folder containing this file in 'Thumbnails' view, the vulnerable code is triggered, leading to arbitrary code execution. The module supports multiple Windows targets (Windows 2000 SP0/SP4 English, Windows XP SP3 English) and includes logic for SEH and ROP-based exploitation. The payload is fully customizable using Metasploit's payload system, allowing for a variety of post-exploitation actions. The attack vector is local, as it requires the user to interact with the malicious file on their system. The only fingerprintable endpoint is the generated malicious file itself. The code is mature and weaponized, as it is part of the Metasploit framework and supports multiple payloads and targets.