Rapid7

module

Microsoft Works 7 WkImgSrv.dll WKsPictureInterface() ActiveX Code Execution

Try Surface Command
Back to search
Disclosed
Nov 28, 2008
Created
May 30, 2018

Description

The Microsoft Works ActiveX control (WkImgSrv.dll) could allow a remote attacker
to execute arbitrary code on a system. By passing a negative integer to the
WksPictureInterface method, an attacker could execute arbitrary code on the system
with privileges of the victim. Change 168430090 /0X0A0A0A0A to 202116108 / 0x0C0C0C0C FOR IE6.
This control is not marked safe for scripting, please choose your attack vector carefully.

Author

dean [email protected]

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/fileformat/msworks_wkspictureinterface
    msf exploit(msworks_wkspictureinterface) > show targets
        ...targets...
    msf exploit(msworks_wkspictureinterface) > set TARGET < target-id >
    msf exploit(msworks_wkspictureinterface) > show options
        ...show and set options...
    msf exploit(msworks_wkspictureinterface) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report