CVE-2010-3973
WMI Administrative Tools < 1.1 - Remote Code Execution via WBEMSingleView.ocx AddContextRef Method
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-3973.
PoCs published by Metasploit, WooYun, WooYun, MC, jduck, including Metasploit module exploits/windows/browser/wmi_admintools.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in the Microsoft WMI Administration Tools ActiveX control (WEBSingleView.ocx) via a trusted pointer dereference in 'AddContextRef' and 'ReleaseContext' methods. It uses heap spraying and ROP with mscorie.dll to bypass DEP/ASLR, achieving arbitrary code execution.
Description
The WMITools ActiveX control in WBEMSingleView.ocx 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted argument to the AddContextRef method, possibly an untrusted pointer dereference, aka "Microsoft WMITools ActiveX Control Vulnerability."
Exploits (3)
This Metasploit module exploits a buffer overflow in the Microsoft WMI Administration Tools ActiveX control (WEBSingleView.ocx) via a trusted pointer dereference in 'AddContextRef' and 'ReleaseContext' methods. It uses heap spraying and ROP with mscorie.dll to bypass DEP/ASLR, achieving arbitrary code execution.
This exploit leverages a heap spray technique to trigger a use-after-free vulnerability in the Adobe Flash Player ActiveX control (CVE-2010-4588), executing arbitrary shellcode (calc.exe in this case) via a crafted HTML file.
This Metasploit module exploits a buffer overflow in the Microsoft WMI Administration Tools ActiveX control (WEBSingleView.ocx) by treating the 'lCtxHandle' parameter as a trusted pointer, leading to arbitrary code execution. It uses heap spraying and .NET 2.0 'mscorie.dll' to bypass DEP and ASLR.