exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-93754

Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow

Posted Jun 10, 2013

Authored by sinn3r, h1ch4m | Site metasploit.com

This Metasploit module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX component, specifically PDF_IN_1.ocx. When a long string of data is given to the ConnectToSynactis function, which is meant to be used for the ldCmdLine argument of a WinExec call, a strcpy routine can end up overwriting a TRegistry class pointer saved on the stack, and results in arbitrary code execution under the context of the user. Also note that since the WinExec function is used to call the default browser, you must be aware that: 1) The default must be Internet Explorer, and 2) When the exploit runs, another browser will pop up. Synactis PDF In-The-Box is also used by other software such as Logic Print 2013, which is how the vulnerability was found and publicly disclosed.

tags | exploit, arbitrary, code execution, activex

advisories | OSVDB-93754

SHA-256 | 717b46a540961e751ccf7b61962579a6966ed5098437c588fd29d0ce3364ac7b

Download | Favorite | View