Buffer Overflow in Yahoo! Messenger Webcam Upload ActiveX Control

This repository contains a single Metasploit module targeting a stack buffer overflow vulnerability in the Yahoo! Messenger 8.1.0.249 Webcam Upload ActiveX control (ywcupl.dll). The exploit is delivered via a malicious HTML page served by the attacker's HTTP server, which instantiates the vulnerable ActiveX control using its CLSID and triggers the overflow by assigning an overly long string to the 'server' property and calling the 'send' method. The module supports customizable payloads, typically providing a shell (bind or reverse) on the victim's Windows XP or Windows 2000 system. The exploit is operational and leverages browser-based attack vectors, requiring the victim to visit the attacker's page. The only fingerprintable endpoints are the vulnerable DLL and its CLSID. The code is structured as a standard Metasploit exploit module, with the main logic in the 'on_request_uri' method, which serves the exploit HTML and handles payload delivery.