rapid7/metasploit-framework — pull request #451 by jvazquez-r7 (2012-06-05 16:29:55+00:00)
Title: MS11-093 ole32 Type Confusion Exploit

At this moment the module uses the VSD PoC provided by Luigi. Since strings are managed as Unicode at the moment jump is granted to a 0x00xx00xx address after type confusion.

Because of this the module exploits only IE6 and IE7 at the moment, using PE Header address of IEXPLORE.EXE as pointer to the sprayed Heap. (same technique as used by Luigi in his PoC).