CVE-2012-0266
NTR ActiveX Control < 2.0.4.8 - Remote Code Execution via Long bstrUrl or bstrParams
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2012-0266.
PoCs published by Metasploit, Carsten Eiram, juan vazquez, including Metasploit module exploits/windows/browser/ntr_activex_check_bof.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in the NTR ActiveX Control's Check() method via a malicious web page, achieving remote code execution. It uses heap spraying and ROP chains to bypass DEP/ASLR on various Windows and IE versions.
Description
Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3) Download or (4) DownloadModule method during construction of a .ntr pathname, or a long bstrUrl parameter to the (5) Download or (6) DownloadModule method during construction of a URL.
Exploits (2)
This Metasploit module exploits a buffer overflow in the NTR ActiveX Control's Check() method via a malicious web page, achieving remote code execution. It uses heap spraying and ROP chains to bypass DEP/ASLR on various Windows and IE versions.
This Metasploit module exploits a buffer overflow vulnerability in the NTR ActiveX Control's Check() method via insecure usage of strcat, leading to remote code execution. It includes heap spraying techniques and ROP chains to bypass DEP/ASLR on various Windows versions.