##
# $Id: wmi_admintools.rb 11405 2010-12-23 01:36:54Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::Remote::BrowserAutopwn

	autopwn_info({
		:os_name    => OperatingSystems::WINDOWS,
		:rank       => NormalRanking,
		:vuln_test  => nil,
	})

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft WMI Administration Tools ActiveX Buffer Overflow',
			'Description'    => %q{
					This module exploits a memory trust issue in the Microsoft WMI
				Administration tools ActiveX control. When processing a specially crafted
				HTML page, the WEBSingleView.ocx ActiveX Control (1.50.1131.0) will treat
				the 'lCtxHandle' parameter to the 'AddContextRef' and 'ReleaseContext' methods
				as a trusted pointer. It makes an indirect call via this pointer which leads
				to arbitrary code execution.

				This exploit utilizes a combination of heap spraying and the
				.NET 2.0 'mscorie.dll' module to bypass DEP and ASLR. This module does not
				opt-in to ASLR. As such, this module should be reliable on all Windows
				versions.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'WooYun', 'MC', 'jduck' ],
			'Version'        => '$Revision: 11405