rapid7/metasploit-framework — pull request #457 by jvazquez-r7 (2012-06-07 10:51:06+00:00)
Title: Added module for OSVDB 81453

Added module for NET-i viewer BackupToAvi() Buffer Overflow.

In fact, it is an integer overflow which leads to a stack buffer overflow because of a memcpy with an incorrect size. Since "size" isn't totally controlled it is crashing through a exception. Because of this the SEH handler overwrite technique is used.

But NET-i viewer modules, without Safeseh, are rebased within IEXPLORE.exe. Because of this a valid stackpivot has not been found and DEP bypass is not provided at this moment.