Stack-based buffer overflow in Microsoft HTML Help Workshop .hhp Contents field

This repository contains a single Metasploit module targeting a stack buffer overflow vulnerability (CVE-2006-0564) in Microsoft HTML Help Workshop 4.74 (hhw.exe v4.74.8702.0) on Windows XP SP3. The exploit works by generating a specially crafted .hhp project file (default name: msf.hhp) that, when opened by the vulnerable application, triggers a buffer overflow and executes arbitrary code. The module uses Metasploit's egghunter technique to deliver the payload, which can be any Metasploit-compatible shellcode up to 1024 bytes, avoiding certain bad characters. The attack vector is local, requiring user interaction to open the malicious file. The repository is structured as a single Ruby file within the Metasploit framework, leveraging its file format and egghunter exploit mixins. No network endpoints are involved; the main fingerprintable artifacts are the malicious .hhp file and the target application (hhw.exe).

This repository contains a single Metasploit module targeting a stack buffer overflow vulnerability (CVE-2006-0564) in Microsoft HTML Help Workshop 4.74 (specifically hhw.exe v4.74.8702.0) on Windows XP SP3. The exploit works by generating a specially crafted .hhp (HTML Help Project) file that, when opened by the vulnerable application, triggers a buffer overflow and executes arbitrary code supplied as a payload. The module uses Metasploit's egghunter technique to locate the payload in memory and allows the attacker to specify the payload type (e.g., reverse shell, meterpreter). The only fingerprintable endpoint is the malicious .hhp file itself, which is created as 'msf.hhp' by default. The exploit is operational and requires user interaction (the victim must open the file). The code is written in Ruby and is structured as a standard Metasploit exploit module.