ICONICS WebHMI ActiveX Buffer Overflow

This module exploits a vulnerability found in ICONICS WebHMI's ActiveX control. By supplying a long string of data to the 'SetActiveXGUID' parameter, GenVersion.dll fails to do any proper bounds checking before this input is copied onto the stack, which causes a buffer overflow, and results arbitrary code execution under the context of the user.

Search Other Modules

Exploit Rank

• Good

Exploit Authors

• Scoot Bell < scott.bell [at] security-assessment.com >
• Blair Strang < blair.strang [at] security-assessment.com >
• sinn3r < sinn3r [at] metasploit.com >

Vulnerability References

• OSVDB-72135
• http://www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf
• EDB-17240
• http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-080-02.pdf

Exploit Targets

• 0 - Automatic (default)
• 1 - IE 6/7/8 on Windows XP SP3
• 2 - IE 7 on Windows Vista

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/scada/citect_scada_odbc
• exploit/windows/scada/codesys_web_server
• exploit/windows/scada/daq_factory_bof
• exploit/windows/scada/factorylink_csservice
• exploit/windows/scada/factorylink_vrn_09
• exploit/windows/scada/iconics_genbroker
• exploit/windows/scada/igss9_igssdataserver_listall
• exploit/windows/scada/igss9_igssdataserver_rename
• exploit/windows/scada/igss9_misc
• exploit/windows/scada/moxa_mdmtool

Exploit Usage Information

Exploit Module Options