CVE-2008-2683

This exploit demonstrates two vulnerabilities in Black Ice Software's Barcode SDK (BIDIB.ocx): arbitrary file download and memory corruption via the DownloadImageFileURL method. The PoC uses VBScript to trigger these issues in Internet Explorer.

This exploit leverages an insecure method in the Black Ice Cover Page ActiveX control to download arbitrary files to a target system. The Metasploit module automates the attack by serving a malicious HTML page that triggers the vulnerability.

This Metasploit module exploits a vulnerability in the Black Ice BIImgFrm.ocx ActiveX control (version 12.0.0.0) to achieve arbitrary file download and remote code execution via the DownloadImageFileURL method. It leverages WMI (Windows Management Instrumentation) to execute a payload on Windows systems prior to Vista.

This Metasploit module exploits CVE-2008-2683 by abusing the 'DownloadImageFileURL' method in the Black Ice BIImgFrm.ocx ActiveX control to download arbitrary files. It achieves remote code execution by uploading a payload and a MOF file, leveraging Windows Management Instrumentation (WMI) to execute the payload.