Arbitrary Code Execution via Unsafe ActiveX Control in Cisco AnyConnect VPN Client

This repository contains a single Metasploit module (modules/exploits/windows/browser/cisco_anyconnect_exec.rb) that exploits a vulnerability (CVE-2011-2039) in the Cisco AnyConnect VPN Client's ActiveX control (vpnweb.ocx) on Windows. The exploit works by serving a malicious web page to the victim, which instantiates the vulnerable ActiveX control and sets its 'url' property to point to the attacker's server. The control then downloads and executes a file (vpndownloader.exe) provided by the attacker, which contains a customizable Metasploit payload. The module also serves an 'updates.txt' file as part of the control's expected behavior. The exploit is weaponized, allowing the attacker to execute arbitrary code on the victim's system. The attack vector is browser-based, requiring user interaction (visiting a malicious page) and a vulnerable configuration (the ActiveX control installed and enabled). The code is written in Ruby and is structured as a standard Metasploit exploit module.