CVE-2007-2987

This Metasploit module exploits an arbitrary file download vulnerability in the Zenturi ProgramChecker ActiveX control (sasatl.dll 1.5.0.531) to place a malicious executable on the target system. It uses a crafted HTML page with JavaScript to trigger the DownloadFile method, delivering a payload EXE to a specified path.

This is a working proof-of-concept exploit for a remote buffer overflow vulnerability in Zenturi ProgramChecker ActiveX (sasatl.dll). It leverages a crafted buffer to overwrite EIP and execute shellcode via a heap spray technique.

This Metasploit module exploits an arbitrary file download vulnerability in the Zenturi ProgramChecker ActiveX control (sasatl.dll 1.5.0.531) via CVE-2007-2987. It delivers a payload by hosting an HTML page that triggers the vulnerable ActiveX control to download and execute an arbitrary file.

This exploit leverages a heap spray technique to trigger a buffer overflow in the Zenturi NixonMyPrograms Class (sasatl.dll v. 1.5.0.531) via the Scan() method, executing calc.exe as a payload. The exploit is delivered through a malicious HTML page targeting Internet Explorer.