module

KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability

Try Surface Command
Back to search
Disclosed
2012-06-26
Created
2018-05-30

Description

This module exploits a code execution vulnerability in the KeyScript ActiveX
control from keyhelp.ocx. It is packaged in several products or GE, such as
Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy
Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver between 7.20 and 7.42.
When the control is installed with these products, the function "LaunchTriPane"
will use ShellExecute to launch "hh.exe", with user controlled data as parameters.
Because of this, the "-decompile" option can be abused to write arbitrary files on
the remote system.

Code execution can be achieved by first uploading the payload to the remote
machine, and then upload another mof file, which enables Windows Management
Instrumentation service to execute it. Please note that this module currently only
works for Windows before Vista.

On the other hand, the target host must have the WebClient service (WebDAV
Mini-Redirector) enabled. It is enabled and automatically started by default on
Windows XP SP3

Authors

rgod [email protected]
juan vazquez [email protected]

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/browser/keyhelp_launchtripane_exec
    msf exploit(keyhelp_launchtripane_exec) > show targets
        ...targets...
    msf exploit(keyhelp_launchtripane_exec) > set TARGET < target-id >
    msf exploit(keyhelp_launchtripane_exec) > show options
        ...show and set options...
    msf exploit(keyhelp_launchtripane_exec) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today