Stack-based Buffer Overflow in Citrix Access Gateway NSEPA ActiveX Control

This repository contains a single Metasploit module targeting a stack-based buffer overflow vulnerability (CVE-2011-2882) in the Citrix Gateway ActiveX control. The exploit is delivered via a malicious HTML page served by the Metasploit framework's HTTP server. When a victim using Internet Explorer (IE6 or IE7) on Windows XP SP3 or Windows Vista visits the page and interacts with a dialog, a heap spray in JavaScript is used to deliver shellcode, exploiting the buffer overflow in the ActiveX control. The module supports multiple targets and automatically selects the appropriate return address based on the User-Agent. The exploit requires user interaction and delivers a customizable Metasploit payload, resulting in code execution with user privileges. The module references the vulnerable ActiveX control by its CLSID and serves the binary as needed. The code is operational and leverages both Ruby (Metasploit) and JavaScript (heap spray) to achieve exploitation.