Remote Code Execution in MacroVision FLEXnet Connect/InstallShield Update Service ActiveX Control

This repository contains a single Metasploit module (macrovision_downloadandexecute.rb) that exploits a stack buffer overflow vulnerability (CVE-2007-5660) in Macrovision InstallShield Update Service (Isusweb.dll 6.0.100.54472). The exploit targets Windows XP SP0/SP1 Pro English and Windows 2000 Pro English systems. It works by serving a malicious HTML page with embedded JavaScript and an ActiveX object (classid: E9880553-B8A7-4960-A668-95C68BED571E). When the vulnerable DownloadAndExecute method is called with an overly long ProductCode parameter, arbitrary code execution is achieved. The module is operational and allows for customizable payloads via Metasploit, typically resulting in a shell or similar access on the victim machine. The main attack vector is through a web browser visiting the attacker's server. The repository is structured as a single Ruby file compatible with the Metasploit framework.

This repository contains a single Metasploit module targeting a vulnerability (CVE-2007-5660) in the Macrovision InstallShield Update Service ActiveX control (2008) on Windows. The exploit works by serving a malicious HTML page via an HTTP server. When a victim visits the page with a vulnerable Internet Explorer configuration, the page instantiates the unsafe ActiveX control and calls its methods to download and execute a payload (a Windows executable generated by Metasploit) from the attacker's server. The module is fully integrated into Metasploit, allowing the attacker to select and configure payloads. The main attack vector is browser-based, exploiting client-side vulnerabilities via a malicious web page. The only endpoints involved are the dynamically generated HTTP URLs used to deliver the payload and exploit page. The code is mature and weaponized, as it is part of the Metasploit framework and supports customizable payloads.