what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-74510

HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution

Posted Aug 21, 2011

Authored by Andrea Micalizzi, juan vazquez | Site metasploit.com

This Metasploit module allows remote attackers to place arbitrary files on a users file system by abusing via Directory Traversal attack the "saveXML" method from the "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control (HPTicketMgr.dll 2.7.2.0). Code execution can be achieved by first uploading the payload to the remote machine embedding a vbs file, and then upload another mof file, which enables Windows Management Instrumentation service to execute the vbs. Please note that this module currently only works for Windows before Vista.

tags | exploit, remote, arbitrary, code execution, activex

systems | windows

advisories | CVE-2011-2404, OSVDB-74510

SHA-256 | 84e0285d988e56bb5f1d65fe424e699563286b8c897e9124e79191ab37a3ba2d

Download | Favorite | View