CVE-2012-2516

Related Files

KeyHelp ActiveX LaunchTriPane Remote Code Execution

Posted Oct 11, 2012

Authored by rgod, juan vazquez | Site metasploit.com

This Metasploit module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42. When the control is installed with these products, the function "LaunchTriPane" will use ShellExecute to launch "hh.exe", with user controlled data as parameters. Because of this, the "-decompile" option can be abused to write arbitrary files on the remote system. Code execution can be achieved by first uploading the payload to the remote machine, and then upload another mof file, which enables Windows Management Instrumentation service to execute it. Please note that this module currently only works for Windows before Vista. On the other hand, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3

tags | exploit, remote, arbitrary, code execution, activex

systems | windows

advisories | CVE-2012-2516, OSVDB-83311

SHA-256 | ddfde3a6cd95fb91cc1c6b3a0ce469bb1d439179f47acc6c7c8348a5fef601f0

Download | Favorite | View

Zero Day Initiative Advisory 12-169

Posted Aug 29, 2012

Authored by Tipping Point | Site zerodayinitiative.com

Zero Day Initiative Advisory 12-169 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy Historian. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the KeyHelp.ocx ActiveX control. The control contains a LaunchTriPane function that allows launching of the HTML Help executable (hh.exe) with customized command line parameters. By using the -decompile switch, an attacker can specify the folder to decompile to and a UNC path to a specially crafted .chm file. The attacker can utilize this vulnerability to execute remote code under the context of the process.

tags | advisory, remote, arbitrary, activex

advisories | CVE-2012-2516

SHA-256 | 1d9cc5e9c9e4b44c3492912b95ec7b4338a90ddb678216b44fd28eec565c9802

Download | Favorite | View