CVE-2010-1885
EXPLOITEDWindows XP and Windows Server 2003 - Remote Code Execution via Malformed hcp:// URL
Title source: llmExploitation Summary
CVE-2010-1885 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Tavis Ormandy, Tavis Ormandy, natron, including a Metasploit module exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-1885, a vulnerability in Microsoft Help Center that allows arbitrary command execution via a combination of XSS and improper input validation in the hcp:// protocol handler. It uses a multi-stage attack involving WebDAV, ASX files, and JavaScript to trigger payload execution.
Description
The MPC::HexToNum function in helpctr.exe in Microsoft Windows Help and Support Center in Windows XP and Windows Server 2003 does not properly handle malformed escape sequences, which allows remote attackers to bypass the trusted documents whitelist (fromHCP option) and execute arbitrary commands via a crafted hcp:// URL, aka "Help Center URL Validation Vulnerability."
Exploits (3)
This Metasploit module exploits CVE-2010-1885, a vulnerability in Microsoft Help Center that allows arbitrary command execution via a combination of XSS and improper input validation in the hcp:// protocol handler. It uses a multi-stage attack involving WebDAV, ASX files, and JavaScript to trigger payload execution.
The writeup details a vulnerability in Microsoft Windows Help Centre (CVE-2010-1885) where malformed escape sequences in hcp:// URLs bypass the whitelist due to an error in MPC::HexToNum(). This allows arbitrary help document access and potential XSS exploitation via sysinfomain.htm.
This Metasploit module exploits CVE-2010-1885, a vulnerability in Microsoft Help Center that allows arbitrary command execution via a combination of XSS and improper input validation in the 'hcp://' protocol handler. It sets up an HTTP server to deliver a malicious payload through crafted ASX and HTML files, targeting Internet Explorer and Windows Media Player.