CVE-2012-4598

This Metasploit module exploits a vulnerability in McAfee Virtual Technician's MVTControl ActiveX control via the GetObject() function to load unsafe classes like WScript.Shell, enabling remote code execution under the user's context.

This exploit leverages a security bypass in McAfee Virtual Technician's ActiveX control (MVT.MVTControl.6300) via the GetObject() function to execute arbitrary commands (e.g., launching calc.exe) or crash the browser by specifying invalid memory addresses. The control is marked as safe for scripting, allowing remote exploitation via Internet Explorer.

This Metasploit module exploits a vulnerability in McAfee Virtual Technician's MVTControl ActiveX control by abusing the GetObject() function to load unsafe classes like WScript.Shell, leading to remote code execution under the user's context.